Use LDAP queries only against directory services you own or are explicitly authorized to assess. Avoid exposing directory data in reports or screenshots.
🔎 Discover Naming Contexts
ldapsearch -x -H ldap://target -s base -b "" namingContexts
| Option | Purpose |
|---|---|
-x |
Use simple authentication instead of SASL |
-H ldap://target |
Specify the LDAP URI |
-s base |
Search only the base object |
-b "" |
Query the Root DSE |
namingContexts |
Request the directory naming contexts |
🗂️ Query a Base DN
ldapsearch -x -H ldap://target -b "DC=domain,DC=com"
-b sets the base distinguished name for the search.
👥 Return Directory Objects
ldapsearch -x -H ldap://target -b "DC=domain,DC=com" "(objectClass=*)"
The filter (objectClass=*) matches directory objects that have an object class.
Anonymous search is frequently disabled. When credentials are required, use an approved low-privilege account and avoid placing passwords directly in shell history.