Locked Ldapnomnom v1.1 - Anonymously bruteforce Active Directory username

[itsMe]

This is the hidden content, please

• Sign In
• or
• Sign Up

Anonymously bruteforce Active Directory usernames from Domain Controllers by abusing LDAP Ping requests (cLDAP)

Looks for enabled normal user accounts. No Windows audit logs were generated. High-speed ~ up to 10K/sec – go beyond 25K/sec with multiple servers!

    Tries to autodetect DC from environment variables on domain joined machines or falls back to machine hostname FQDN DNS suffix
    Reads usernames to test from stdin (default) or file
    Outputs to stdout (default) or file
    Parallelized, multiple connections to multiple servers (defaults to 8 servers, 8 connections per server)
    Shows a progressbar if you’re using both input and output files
    Evasive maneuvers: Use –throttle 20 for a 20ms delay between each request (slows everything down to a crawl)
    Evasive maneuvers: Use –maxrequests 1000 to close the connection and reconnect after 1000 requests in each connection (try to avoid detection based on traffic volume)

Changelog v1.1

    64921bd: Fixed output for detected DNS domain (Lars Karlslund)
    6ea0cd7: Fixed closing of output when exiting (Lars Karlslund)
    61637bd: Added option to dump rootDSE attributes as JSON (Lars Karlslund)

This is the hidden content, please

• Sign In
• or
• Sign Up