📒 LDAP — Port 389

Don't trust Nmap auto-enum — use ldapsearch.

ldapsearch -x -b "dc=google,dc=com" -H IP            # simple auth + search base
ldapsearch -x -H ldap://10.129.248.172 -D '' -w '' -b "CN=TempAdmin,OU=Users,OU=UK,DC=cascade,DC=local"
python3 windapsearch.py --dc-ip 10.129.242.138 --full

Flags: -x simple auth · -b search base (e.g. "dc=google,dc=com") · -D/-w bind DN/password.

Cadaver — if LDAP/WebDAV is writable

cadaver http://IP      # login, then: put file   → open http://IP/filename

LDAP is an AD goldmine. For domain context see methodology, and LAPS dumping over LDAP in tools (crackmapexec -M laps).