Skip to content
HackIndex logo

HackIndex

LDAP RootDSE and Anonymous Bind Checks

4 min read Apr 5, 2026

RootDSE is the entry point for every LDAP server. It is always readable without authentication and reveals the base DN, domain name, domain controller hostname, supported LDAP versions, SASL mechanisms, and whether anonymous bind is permitted. Run this first on every engagement before attempting any authenticated or unauthenticated query.

Nmap — initial discovery

Use nmap to confirm LDAP is running and pull RootDSE in a single pass. This also tests whether the server responds to unauthenticated queries.

┌──(kali㉿kali)-[~]
└─$ # RootDSE + anonymous search
┌──(kali㉿kali)-[~]
└─$ nmap -p 389,636,3268,3269 --script ldap-rootdse,ldap-search $TARGET_IP
 
┌──(kali㉿kali)-[~]
└─$ # LDAP only
┌──(kali㉿kali)-[~]
└─$ nmap -p 389 --script ldap-rootdse $TARGET_IP
 
┌──(kali㉿kali)-[~]
└─$ # LDAPS
┌──(kali㉿kali)-[~]
└─$ nmap -p 636 --script ldap-rootdse $TARGET_IP 
PORT    STATE SERVICE
389/tcp open  ldap
| ldap-rootdse:
|   dnsHostName: DC01.corp.local
|   defaultNamingContext: DC=corp,DC=local
|   domainFunctionality: 7
|   supportedSASLMechanisms: GSSAPI, GSS-SPNEGO, NTLM, DIGEST-MD5
|_  isGlobalCatalogReady: TRUE

From nmap output, extract these values immediately — you need them for every subsequent query:

  • defaultNamingContext — this is your $BASE_DN, e.g. DC=corp,DC=local

  • dnsHostName — the DC's FQDN, useful for Kerberos auth

  • domainFunctionality — 7 = Windows Server 2016+, affects which attacks are viable

  • supportedSASLMechanisms — presence of NTLM means you can relay; absence of Kerberos on a DC is unusual

Port 3268 is the Global Catalog — it contains partial objects from all domains in the forest. Query it when you need cross-domain user data. Port 3269 is LDAPS Global Catalog.

ldapsearch — RootDSE and anonymous bind test

┌──(kali㉿kali)-[~]
└─$ # Full RootDSE — all attributes
┌──(kali㉿kali)-[~]
└─$ ldapsearch -x -H ldap://$TARGET_IP -s base -b "" "(objectClass=*)"
 
┌──(kali㉿kali)-[~]
└─$ # Naming contexts only — fastest way to get base DN
┌──(kali㉿kali)-[~]
└─$ ldapsearch -x -H ldap://$TARGET_IP -s base namingContexts
 
┌──(kali㉿kali)-[~]
└─$ # Test anonymous bind — any response means anon bind is allowed
┌──(kali㉿kali)-[~]
└─$ ldapsearch -x -H ldap://$TARGET_IP -s base
 
┌──(kali㉿kali)-[~]
└─$ # LDAPS test
┌──(kali㉿kali)-[~]
└─$ ldapsearch -x -H ldaps://$TARGET_IP -s base namingContexts
 
┌──(kali㉿kali)-[~]
└─$ # LDAPS with self-signed cert
┌──(kali㉿kali)-[~]
└─$ LDAPTLS_REQCERT=never ldapsearch -x -H ldaps://$TARGET_IP -s base namingContexts 
# extended LDIF
#
# LDAPv3
# base <> with scope baseObject
# filter: (objectClass=*)
# requesting: namingContexts

#
namingContexts: DC=corp,DC=local
namingContexts: CN=Configuration,DC=corp,DC=local
namingContexts: CN=Schema,CN=Configuration,DC=corp,DC=local
namingContexts: DC=DomainDnsZones,DC=corp,DC=local
namingContexts: DC=ForestDnsZones,DC=corp,DC=local

# search result
search: 2
result: 0 Success

result: 0 Success with data returned confirms anonymous bind is permitted. If you get result: 1 Operations error or result: 50 Insufficient access rights with no data, anonymous access is blocked and you need credentials.

The naming contexts tell you the structure of the directory. DC=corp,DC=local is the domain root and your primary search base. CN=Configuration contains sites, services, and forest-level settings. CN=Schema contains the attribute and class definitions — useful for finding non-standard attributes.

nxc — quick anonymous bind check

┌──(kali㉿kali)-[~]
└─$ # Test anonymous bind
nxc ldap $TARGET_IP -u '' -p ''
 
# Test with null username
nxc ldap $TARGET_IP -u '' -p '' --get-sid 
LDAP  10.10.10.10  389  DC01  [*] Windows Server 2019 (domain:corp.local) (signing:True) (SMBv1:False)
LDAP  10.10.10.10  389  DC01  [-] corp.local\: STATUS_ACCESS_DENIED

Even when anonymous bind fails, nxc returns the domain name, OS version, and signing status from the initial connection — this is always useful regardless of auth state. signing:True means LDAP signing is required, which blocks NTLM relay attacks against LDAP. See LDAP Signing and Channel Binding for how to verify and exploit this.

What to do next based on results

References