windapsearch

Canned LDAP queries against a DC: users, groups and privileges.

It wraps the most useful LDAP queries of an AD engagement into named options, so you do not have to remember raw filters. With domain credentials (any low-privileged user will do) it pulls the user and group list, the Domain Admins members (`--da`), the privileged accounts (`--privileged-users`), the domain computers and the users with a filled-in description, where a forgotten password often lives. It is fast authenticated enumeration before you bring out BloodHound.

Family Active Directory enumeration

Flags -d -u -p --da --privileged-users --computers

Concepts LDAP Enumeration, Credential Hunting

Cheatsheet Enumeration

Installation

git clone https://github.com/ropnop/windapsearch && cd windapsearch
pip3 install python-ldap
./windapsearch.py -d <domain> --dc-ip <ip> -U   # enumerar usuarios (bind anonimo o -u/-p)

Repositorygithub.com/ropnop/windapsearch

Useful commands4 commands

Reference tool: it does not yet appear in a published machine on the blog, but it is part of the arsenal for its everyday use.