{"id":13489489,"url":"https://github.com/lkarlslund/ldapnomnom","last_synced_at":"2025-05-15T02:10:23.243Z","repository":{"id":59612742,"uuid":"538075061","full_name":"lkarlslund/ldapnomnom","owner":"lkarlslund","description":"Quietly and anonymously bruteforce Active Directory usernames at insane speeds from Domain Controllers by (ab)using LDAP Ping requests (cLDAP)","archived":false,"fork":false,"pushed_at":"2024-11-09T10:15:13.000Z","size":151,"stargazers_count":1026,"open_issues_count":0,"forks_count":80,"subscribers_count":16,"default_branch":"main","last_synced_at":"2025-04-14T00:58:35.074Z","etag":null,"topics":["active-directory","bruteforce","bruteforcer","cldap","ldap"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/lkarlslund.png","metadata":{"files":{"readme":"readme.MD","changelog":null,"contributing":null,"funding":null,"license":"license.MD","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2022-09-18T10:35:09.000Z","updated_at":"2025-04-09T01:59:26.000Z","dependencies_parsed_at":"2023-12-15T17:30:50.348Z","dependency_job_id":"25e69af7-0697-40f3-acbb-aaebe76033be","html_url":"https://github.com/lkarlslund/ldapnomnom","commit_stats":{"total_commits":39,"total_committers":2,"mean_commits":19.5,"dds":0.02564102564102566,"last_synced_commit":"6dbe9fecd16697320e486de56135a0926673b30c"},"previous_names":[],"tags_count":14,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lkarlslund%2Fldapnomnom","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lkarlslund%2Fldapnomnom/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lkarlslund%2Fldapnomnom/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lkarlslund%2Fldapnomnom/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/lkarlslund","download_url":"https://codeload.github.com/lkarlslund/ldapnomnom/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":254259387,"owners_count":22040821,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["active-directory","bruteforce","bruteforcer","cldap","ldap"],"created_at":"2024-07-31T19:00:28.904Z","updated_at":"2025-05-15T02:10:18.189Z","avatar_url":"https://github.com/lkarlslund.png","language":"Go","funding_links":[],"categories":["Go"],"sub_categories":[],"readme":"# LDAP Nom Nom\n\n*Quietly and anonymously bruteforce Active Directory usernames at insane speeds from Domain Controllers by (ab)using LDAP Ping requests (cLDAP)*\n\nLooks for enabled normal user accounts. No Windows audit logs generated. High speed ~ up to 50K/sec per server - go way beyond that with multiple servers in parallel!\n\n[![GitHub all releases](https://img.shields.io/github/downloads/lkarlslund/ldapnomnom/total)](https://github.com/lkarlslund/ldapnomnom/releases) ![GitHub Workflow Status](https://img.shields.io/github/actions/workflow/status/lkarlslund/ldapnomnom/prerelease.yml?branch=main)\n\n![Highspeed bruteforcing using generated usernames](bruteforce-50k.png)\n\n- Tries to autodetect DC from environment variables on domain joined machines or falls back to machine hostname FQDN DNS suffix\n- Reads usernames to test from stdin (default) or file\n- Outputs to stdout (default) or file\n- Parallelized, multiple connections to multiple servers (defaults to 8 servers, 8 connections per server)\n- Shows progressbar if you're using both input and output files\n- Evasive maneuvers: Use --throttle 20 for a 20ms delay between each request (slows everything down to a crawl)\n- Evasive maneuvers: Use --maxrequests 1000 to close connection and reconnect after 1000 requests in each connection (try to avoid detection based on traffic volume)\n\n### Download auto built binaries from [releases](https://github.com/lkarlslund/ldapnomnom/releases) or build and install with this Go command\n\n```go\ngo install github.com/lkarlslund/ldapnomnom@latest\n```\n\n### Usage\n\n```bash\nldapnomnom [--server dc1.domain.suffix[,dc2.domain.suffix] | --dnsdomain domain.suffix] [--port number] [--tlsmode notls|tls|starttls] [--input filename] [--output filename] [--parallel number-of-connections] [--maxservers number-of-servers] [--maxstrategy fastest|random] [--throttle n] [--maxrequests n]\n```\n\n### Show version\n\n```bash\nldapnomnom version\n```\n\n### Bruteforcing examples\n\nConnect to up to 32 servers from contoso.local with 16 connections to each - FAAAAAAAST\n```bash\nldapnomnom --input 10m_usernames.txt --output multiservers.txt --dnsdomain contoso.local --maxservers 32 --parallel 16\n```\n\nConnect to one named server with 4 connections\n```bash\nldapnomnom --input 10m_usernames.txt --output results.txt --server 192.168.0.11 --parallel 4\n```\n\nLook for username lists to feed into this elsewhere - for instance the 10M list from [here](https://github.com/danielmiessler/SecLists/tree/master/Usernames)\n\n### Extract rootDSE attributes\n\nYou can also use LDAP Nom Nom to dump attributes from the rootDSE object, by adding the \"--dump\" option.\n\nConnect to all servers you can find, and output all readable attributes to JSON:\n```bash\nldapnomnom --output rootDSEs.json --dump\n```\n\n## Detection\n\n- Nothing native in the Windows event logs are generated (tested on Windows 2016 / 2019)\n- Microsoft Defender for Identity 2.228 (February 2024) adds [event ID 2437](https://learn.microsoft.com/en-us/defender-for-identity/reconnaissance-discovery-alerts#account-enumeration-reconnaissance-ldap-external-id-2437-preview) and is triggered if the number of failed requests (i.e. wrong guesses at usernames) crosses an unknown threshold\n- Custom network level monitoring (unencrypted LDAP analysis or traffic volume for LDAPS) can also be used, though it's not reliable\n\n## Mitigation\n\n- None, this is part of the dcLocator stuff\n- Rename your administrator account\n- Audit accounts for having same password as the username\n- Prevent kerberoasting by removing SPNs on as many accounts as possible\n- Use long and complex passwords on accounts with SPNs\n\n## History\n\nDuring a discussion on Twitter about locating Kerberos services, someone hinted the existance of LDAP Ping requests. They're documented on [Microsofts Open Specifications Pages](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/895a7744-aff3-4f64-bcfa-f8c05915d2e9), and it contains pseudo code for how you initiate a LDAP Ping, what parameters it takes and the data returned. It immediately seemed obvious that there is an information leak here that can be abused.\n\nAfter having released the tool, I can see I'm not the only one to spot this \"mistake\" which is clearly still around for historic backwards compatibility reasons.\n\nIf you want to avoid network level detection as an attacker you should use TLS on port 636 (tool defaults to unencrypted LDAP on port 389).\n\nIf you like Active Directory you might also like my attack graph tool [Adalanche](https://github.com/lkarlslund/Adalanche)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Flkarlslund%2Fldapnomnom","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Flkarlslund%2Fldapnomnom","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Flkarlslund%2Fldapnomnom/lists"}