Anonymous LDAP Enumeration

Null Session Herald

Ravenhold's domain controller answers questions. The question is who it will answer them for. Before you can attack a domain you need to see it — accounts, groups, service principals, and the account flags that quietly disable safety features. Ask without credentials and find out how much it volunteers. Target: dc01.ravenhold.xpt

Try: ldapsearch -x -H ldap://dc01.ravenhold.xpt -b "dc=ravenhold,dc=xpt" — the -x is a simple, unauthenticated bind.
hunter@exploitia↑↓ history · ctrl+L clear
Target briefing loaded. Try: ldapsearch -x -H ldap://dc01.ravenhold.xpt -b "dc=ravenhold,dc=xpt" — the -x is a simple, unauthenticated bind.
$