← All Kali Commands
🏰 Active Directory LDAPsearch

No preauth required

LDAPsearch command for no preauth required. Copy the command below and use it in your terminal.

ldapsearch — terminal
┌──(kali㉿kali)-[~]
└─$ ldapsearch -x -H ldap://DC -D "user@domain" -w pass -b "dc=domain,dc=local" "(userAccountControl:1.2.840.113556.1.4.803:=4194304)" dn
Tool
LDAPsearch
Category
Active Directory
Purpose
No preauth required

🛡️ Usage Tips

  • Always ensure you have proper authorization before using LDAPsearch against any target
  • Replace target with the actual IP address or hostname you are testing
  • Run this command from a Kali Linux terminal or any system with LDAPsearch installed
  • Combine with other LDAPsearch commands for more comprehensive results
  • Pipe output to a file with > output.txt for later analysis

🔗 More LDAPsearch Commands

ldapsearch -x -H ldap://DC -b "dc=domain,dc=local"
Anonymous query
ldapsearch -x -H ldap://DC -D "user@domain" -w pass -b "dc=domain,dc=local"
Auth query
ldapsearch -x -H ldap://DC -D "user@domain" -w pass -b "dc=domain,dc=local" "(objectClass=user)"
Find users
ldapsearch -x -H ldap://DC -D "user@domain" -w pass -b "dc=domain,dc=local" "(objectClass=computer)"
Find computers
ldapsearch -x -H ldap://DC -D "user@domain" -w pass -b "dc=domain,dc=local" "(objectClass=group)"
Find groups
ldapsearch -x -H ldap://DC -D "user@domain" -w pass -b "dc=domain,dc=local" "(adminCount=1)"
Admin accounts
ldapsearch -x -H ldap://DC -D "user@domain" -w pass -b "dc=domain,dc=local" "(servicePrincipalName=*)"
Find SPNs
ldapsearch -x -H ldap://DC -b "" -s base namingContexts
Get naming contexts
ldapsearch -x -H ldap://DC -D "user@domain" -w pass -b "dc=domain,dc=local" "(userAccountControl:1.2.840.113556.1.4.803:=524288)" dn
Trusted for delegation
ldapsearch -x -H ldaps://DC -D "user@domain" -w pass -b "dc=domain,dc=local"
LDAPS query
ldapsearch -x -H ldap://DC -D "user@domain" -w pass -b "cn=users,dc=domain,dc=local"
Users container
ldapsearch -x -H ldap://DC -D "user@domain" -w pass -b "dc=domain,dc=local" "(objectClass=organizationalUnit)"
Find OUs

🏰 Other Active Directory Tools

BloodHound Kerbrute CrackMapExec Certipy Impacket Rubeus2
📚 Learn Kali Linux — Free Course