{"id":28700690,"url":"https://github.com/trustedsec/ditexplorer","last_synced_at":"2026-02-23T04:31:59.029Z","repository":{"id":278201610,"uuid":"931633755","full_name":"trustedsec/DitExplorer","owner":"trustedsec","description":"Tool for viewing NTDS.dit","archived":false,"fork":false,"pushed_at":"2025-03-14T13:02:44.000Z","size":1976,"stargazers_count":183,"open_issues_count":7,"forks_count":16,"subscribers_count":4,"default_branch":"master","last_synced_at":"2025-10-20T12:41:16.485Z","etag":null,"topics":["active-directory"],"latest_commit_sha":null,"homepage":"","language":"C#","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/trustedsec.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE.txt","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2025-02-12T15:54:04.000Z","updated_at":"2025-10-15T03:42:41.000Z","dependencies_parsed_at":"2025-02-18T15:34:54.524Z","dependency_job_id":"ba2b4faf-1851-47a4-93a8-a4a049d74e42","html_url":"https://github.com/trustedsec/DitExplorer","commit_stats":null,"previous_names":["trustedsec/ditexplorer"],"tags_count":2,"template":false,"template_full_name":null,"purl":"pkg:github/trustedsec/DitExplorer","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/trustedsec%2FDitExplorer","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/trustedsec%2FDitExplorer/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/trustedsec%2FDitExplorer/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/trustedsec%2FDitExplorer/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/trustedsec","download_url":"https://codeload.github.com/trustedsec/DitExplorer/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/trustedsec%2FDitExplorer/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":29738079,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-02-23T02:24:00.660Z","status":"ssl_error","status_checked_at":"2026-02-23T02:22:56.087Z","response_time":90,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.6:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["active-directory"],"created_at":"2025-06-14T11:30:35.865Z","updated_at":"2026-02-23T04:31:58.993Z","avatar_url":"https://github.com/trustedsec.png","language":"C#","funding_links":[],"categories":[],"sub_categories":[],"readme":"# DIT Explorer\nDIT Explorer is a Windows application written in C# for browsing a NTDS.dit file.\nCreated in Visual Studio 2022.\n\nI wrote this as a tool for researching the structure of NTDS.dit. For more\ninformation, see my [blog post](https://trustedsec.com/blog/exploring-ntds-dit-part-1-cracking-the-surface-with-dit-explorer).\n\n![image](https://github.com/user-attachments/assets/8efd1f31-8d2d-4adc-9832-4b33c68b5dea)\n\n# Building\nTo build the application:\n\n1. Open DitExplorer.sln with Visual Studio 2022.\n2. Build and run DitExplorer.UI.WpfApp\n\n# Using the Application\n\nFrom the main application window, open a .DIT file using File \u003e Open DIT File.\nDIT Explorer uses ManagedEsent to open the database.  If the file was pulled from a\nshadow copy and is unclean, you may need to repair it before opening it with\nDIT Explorer using `esent /p`.\n\nAfter opening a directory database, DIT Explorer displays the hierarchy of the\ndomain on the left-hand side and the contents of the selected node in the right-hand pane.\n\n* To view the attributes, members, and groups of an object, double-click it or right-click `\u003e Properties`.\n* To view the database schema, select `Tools \u003e Database Schema`\n* To view the directory schema, navigate to Configuration\\Schema under the domain.\n* To search a subtree, right-click the node at the root of the subtree, then select `Search Subtree`.\n* To change the attributes shown as columns, select `View \u003e Columns`, or right-click the list view and select `Columns...`\n* To copy one or more items to the clipboard, highlight them, then select one of the Copy commands.\n* To dump hashes, select one or more accounts, then right-click and select `Extract Credentials`\n\nMost of the lists support sorting by clicking the column headers and searching by\ntyping directly into the list.\n\nTo perform an action (such as Extract Credential) on multiple objects within a\nsubtree, search the subtree, highlight the objects in the search results, then\nright-click and select the desired action.\n\n# Customizing the View\n\nIn both the main application window and the Search window, you may select which columns the list displays.\nRight-click in the list, then select `Columns...`\n\n![image](https://github.com/user-attachments/assets/cc40cce8-3deb-49ca-885e-4bb27e1ab3a9)\n\n Column Chooser allows you to select which schema attributes to display as a column in the list view.\n The `Column set` selection allows you to browse the attributes contained by a particular class.\n\n# Searching the Directory\n\nTo search the directory:\n1. Right-click on the node you want to search in, then select `Search Subtree`.\n2. Enter part of the name of the object you wish to search for, or leave the Name field blank to find all objects in the subtree.  DIT Explorer searchs for the\nsearch text within the attributes marked ANR to produce a similar experience to searching for a\nuser in Active Directory.\n3. Optionally select the class of object to search for, optionally\nincluding subclasses.  Leave the selection blank to search for all objects matching the name entered above.\n4. Click `Search Now`.\n5. Interact with the results by selecting and right-clicking them.\n\n![image](https://github.com/user-attachments/assets/c7797618-b0ed-4c64-8cd0-ca939c73d8c7)\n\n# Extracting Credentials\n\nTo extract credentials, you'll need the system key of the DC that you pulled the NTDS.dit file\nfrom.\n\n![image](https://github.com/user-attachments/assets/b930e108-ae30-4e5d-9fe0-c6f3d6e5686f)\n\n1. Right-click the user or computer that you want to extract credentials from, then select `Extract Credentials`.\n3. Enter the system key.\n4. Click `Extract Credentials`.\n5. Click `Export...` to export the credentials to a file.  DIT Explorer supports exporting to a tab-delimited text file, CSV, or pwdump-style text file.\n\n# Viewing the Database Schema\n\n![image](https://github.com/user-attachments/assets/c3969d0e-2aba-4dc1-8b7c-6d01f9e73cc6)\n\n1. Open the .DIT file.\n2. From the `Tools` menu, select `Database Schema`.\n\nThe right-hand pane lists the columns and indexes in the table.  You may highlight and copy a list of columns or indexes to the clipboard.  Use the `Export Table Data` button to export the raw data from the selected table.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftrustedsec%2Fditexplorer","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ftrustedsec%2Fditexplorer","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftrustedsec%2Fditexplorer/lists"}