Python can make repeatable directory queries easier. Use these examples only against LDAP services you own or are explicitly authorized to assess.

🐍 LDAP Enumeration with ldap3

Start Python and import the library:

python3

import ldap3

server = ldap3.Server(
    "target",
    port=389,
    get_info=ldap3.ALL
)

connection = ldap3.Connection(server)
connection.bind()

A successful bind() returns True. If it returns False, inspect connection.result, verify the host and port, and determine whether the server requires credentials or TLS.

Inspect Server Information

server.info

After identifying the correct naming context, query directory objects:

connection.search(
    search_base="DC=domain,DC=com",
    search_filter="(objectClass=*)",
    search_scope=ldap3.SUBTREE,
    attributes=["*"]
)

connection.entries

Query Person Objects

connection.search(
    search_base="DC=domain,DC=com",
    search_filter="(objectClass=person)",
    search_scope=ldap3.SUBTREE,
    attributes=["userPassword"]
)

connection.entries

Directory attributes can contain sensitive organizational and personal information. Request only what the assessment requires, protect the output, and avoid querying password-related attributes unless they are explicitly in scope.