Lightweight Directory Access Protocol
or LDAP is another service
that can be used to gather information about a target.
LDAP is a directory service.
It's a store for usernames
and you can authenticate against it.
As we can see here in this kind of screenshot,
we have a distinguished name.
We have a common name of John Doe
and a domain component of example,
and another domain component of com.
So this is John Doe, not necessarily at example.com.
That might or may not be his email address,
but we know that John Doe is associated
with example.com.
LDAP commonly runs across TCP ports 389 or 636
in the case of Secure LDAP.
As I mentioned, users in this directory
or things in this directory are identified
by a distinguished name.
Here, we see an example
of a distinguished name and a whole bunch
of other attributes that can be associated
with this particular distinguished name.
In this example, we see telephone numbers.
Their email address is john@example.com.
John reports to common name Barbara
Doe also part of example.com.
We have some other objects
that are associated with this particular user.
So if you're running your Nmap and you see 389,
it's an LDAP server, most likely.
Can you connect to it?
Can you enumerate the list of users
from that particular LDAP server?
It is possible to do anonymous LDAP queries
if the server is configured as such.
So give it a shot.
See what information you can get from that LDAP server.
This right here is Softerra LDAP Administrator.
This is a commercial product offering
for managing an LDAP server.
However, it's a pretty good product
for gabbing information from LDAP servers.
Some more tools here, LDAP Admin Tool.
Microsoft offers tools for use.
Active Directory, by the way, runs LDAP.
So if it's a Microsoft Windows type network
where you see a whole bunch of Windows machines
on the network,
they're probably talking to Active Directory.
Where is that Active Directory server
and can you connect to LDAP
on that Active Directory server?