# LDAP Domain Dump 🛡️📜
#Tool #RED #TTAD 

This tool is essential for extracting data from LDAP directories, commonly used in Active Directory environments. Use this guide to navigate LDAP recon like a pro! 🚀

**LDAP Domain Dump** is a utility for querying and extracting information from LDAP directories. It’s a go-to tool for penetration testers and sysadmins to enumerate users, groups, and domain information.

---
![kali standard logo](https://www.kali.org/images/kali-tools-icon-missing.svg)

---
### Installing `ldapdomaindump`

#### **Linux (Debian/Ubuntu-based distros)**
```bash
sudo apt update && sudo apt install ldapdomaindump -y
```

#### **Windows (via pip)**
```powershell
pip install ldapdomaindump
```

---

## 🧰 Common Commands

### 🔍 Basic Enumeration
```bash
ldapdomaindump -u DOMAIN\\user -p password -d domain.local -o output_folder
```
Perform a basic LDAP dump using credentials.

### 🔑 Kerberos Authentication
```bash
ldapdomaindump --kerberos -d domain.local -o output_folder
```
Use Kerberos tickets for LDAP enumeration.

### 📜 Save Output to JSON
```bash
ldapdomaindump -u DOMAIN\\user -p password -d domain.local -o output_folder --json
```
Save results in JSON format for easy parsing.

### 🗂 Filter Specific OU
```bash
ldapdomaindump -u DOMAIN\\user -p password -d domain.local -o output_folder -b "OU=SpecificOU,DC=domain,DC=local"
```
Dump only information from a specific organizational unit.

---

## ⚙️ Advanced Usage

### 🌐 Use LDAP Server IP
```bash
ldapdomaindump -u DOMAIN\\user -p password -d domain.local -o output_folder -s 192.168.1.100
```
Connect directly to an LDAP server using its IP address.

### 🔒 Secure Connection
```bash
ldapdomaindump -u DOMAIN\\user -p password -d domain.local -o output_folder -ssl
```
Enable SSL/TLS for secure communication.

### 🔍 Search Custom Attributes
```bash
ldapdomaindump -u DOMAIN\\user -p password -d domain.local -o output_folder --attributes cn,mail,sAMAccountName
```
Retrieve only specified attributes.

### 🧵 Multithreading
```bash
ldapdomaindump -u DOMAIN\\user -p password -d domain.local -o output_folder --threads 10
```
Enable multithreading to speed up enumeration.

---

## 📋 Handy Options

| Option            | Description                                   |
|-------------------|-----------------------------------------------|
| `-u`              | Username for LDAP authentication             |
| `-p`              | Password for LDAP authentication             |
| `-d`              | Domain to target                             |
| `-o`              | Output directory for results                 |
| `-ssl`            | Enable SSL/TLS for communication             |
| `--kerberos`      | Use Kerberos authentication                  |
| `--attributes`    | Specify custom attributes to retrieve         |
| `-b`              | Base DN for the LDAP query                   |
| `--json`          | Save results in JSON format                  |
| `--threads`       | Set number of threads for faster processing  |

---

## 🌐 Example Scenarios

### Scenario 1: Dump Entire LDAP Directory
```bash
ldapdomaindump -u DOMAIN\\admin -p password123 -d corp.local -o ldap_results
```
Dump all LDAP directory data and save to a folder.

### Scenario 2: Kerberos-Based Enumeration
```bash
ldapdomaindump --kerberos -d corp.local -o ldap_results
```
Use Kerberos tickets to authenticate and query LDAP.

### Scenario 3: Query Specific OU
```bash
ldapdomaindump -u DOMAIN\\admin -p password123 -d corp.local -o ldap_results -b "OU=Finance,DC=corp,DC=local"
```
Enumerate data only from the Finance organizational unit.

---

## 🚀 Pro Tips

### 1️⃣ Optimize Queries
Focus on specific attributes and base DNs to speed up enumeration and reduce noise.

### 2️⃣ Combine Tools
Use LDAP Domain Dump alongside tools like **BloodHound** or **Nmap** for comprehensive recon.

### 3️⃣ Automate Reporting
Export results in JSON format and use scripts to generate custom reports.

---

## 📚 References
- [LDAP Domain Dump GitHub Repository](https://github.com/dirkjanm/ldapdomaindump)
- [Active Directory Basics](https://docs.microsoft.com/en-us/windows-server/identity/)

---