Active Enumeration

Active Enumeration

Main → [3]. Authenticated enumeration, requires valid credentials (set them in Configuration → [3]). The header shows the active username.

[1]  BloodHound Collection
[2]  CrackMapExec (Full Enum)
[3]  AD DNS Dump
[4]  GetNPUsers (ASREPRoast)
[5]  RID Enumeration
[0]  Back to Main Menu

---

[1] BloodHound Collection

Collects the full AD graph (sessions, ACLs, group memberships, trusts) for attack-path analysis in BloodHound.

bloodhound-python -u <user> -p <pass> -d <domain> -ns <target> \
                  -c all --zip -o <output>

Needs target, domain and credentials. Produces JSON (zipped) that you import into the BloodHound GUI, see Output & Results for the import steps. This is the highest-value active module for finding privilege-escalation paths.

---

[2] CrackMapExec

Authenticated SMB enumeration of shares and users. Ghostline auto-detects crackmapexec, cme or nxc (NetExec).

<cme> smb <target> -u <user> -p <pass> --shares   # → cme_shares.txt
<cme> smb <target> -u <user> -p <pass> --users    # → cme_users.txt

Needs target and credentials (domain optional). The shares output shows what your account can read/write; the users output enumerates domain accounts. A fast way to confirm a credential works and see what it unlocks.

---

[3] AD DNS Dump (adidnsdump)

Dumps Active Directory-integrated DNS records over LDAP, including entries hidden from normal zone transfers.

adidnsdump -u '<domain>\<user>' -p <pass> <target> -r \
           --output <output>/dns.csv

Needs target, domain and credentials. -r resolves records that are not directly listable. The result (dns.csv) maps hostnames to IPs across the domain, useful for expanding your target list.

---

[4] GetNPUsers (AS-REP Roasting)

Finds accounts with Kerberos pre-authentication disabled and requests their AS-REP hashes for offline cracking.

GetNPUsers.py <domain>/ -dc-ip <target> -no-pass | tee asreproast.txt

Needs target and domain. Uses -no-pass, so it can run without credentials (it queries the null-session-readable set). Resolves GetNPUsers.py or impacket-GetNPUsers. Any hash returned can be cracked offline with hashcat (-m 18200).

---

[5] RID Enumeration

RID cycling to enumerate domain users by brute-forcing RIDs.

ridenum <target> 500 10000 | tee ridenum.txt

Needs target only. Walks RIDs from 500 to 10000 to recover account names, effective even where direct user enumeration is blocked but the SAM-R interface answers RID lookups.

---

Cracking the loot

Module	Output	Crack with
GetNPUsers	AS-REP hash ($krb5asrep$)	hashcat -m 18200
secretsdump (Special)	NTLM hashes	hashcat -m 1000, or pass-the-hash

After active enumeration, feed BloodHound the JSON to chart paths to Domain Admin, and pivot any cracked or dumped credential back into Configuration to repeat at a higher privilege level.

See also Special Actions for secretsdump and the automated workflow.