# LDAP

> LDAP directory service attacks covering anonymous binds, injection, enumeration of users and groups, relay attacks, credential extraction, and leveraging AD trust paths for lateral movement

- **URL:** https://hackindex.io/services/ldap
- **Type:** Service
- **Default ports:** 389, 636
- **Tags:** ldap, authentication, directory-services, active-directory, enumeration, linux
- **Published:** 2025-12-31
- **Updated:** 2026-07-13

LDAP (Lightweight Directory Access Protocol) runs on **TCP port 389** (plaintext/STARTTLS) and **TCP port 636** (LDAPS with TLS). Nmap identifies them as `ldap` and `ldaps`. In Active Directory environments, LDAP is the primary protocol for querying the directory: users, groups, computers, policies, and more.

Anonymous or null-bind LDAP access can expose the entire directory structure. Even without credentials, the root DSE and naming contexts are often readable, revealing the domain name and forest structure. With valid credentials, LDAP queries return detailed information about every object in the domain, including password policies, group memberships, SPNs, and delegation settings.

Check for anonymous bind access, then query the base DN, users, groups, and computer objects. Tools like `ldapsearch`, `ldapdomaindump`, and `windapsearch` automate this. Look for accounts with descriptions containing passwords, unconstrained delegation, and AS-REP roastable accounts.

## Phases

- [Enumeration](https://hackindex.io/services/ldap/enumeration.md): Enumerate LDAP via anonymous and auth binds, users, groups, misconfigs (5 guides)
- [Vulnerability Discovery](https://hackindex.io/services/ldap/vulnerability-discovery.md): Guides on finding LDAP misconfigs via null bind, signing, and relay checks (2 guides)
- [Exploitation](https://hackindex.io/services/ldap/exploitation.md): Anonymous bind, injection, pass-back, brute force, and credential extractio (6 guides)