Passive Enumeration

Passive Enumeration

Main → [2]. Reconnaissance that needs no credentials. These modules query services that are often exposed anonymously on a Domain Controller. Each one checks its tool is installed, creates the output directory, runs, and tees results to disk.

[1]  Nmap Scan (Port Discovery)
[2]  Enum4linux-ng (SMB Enumeration)
[3]  RPC Client (Null Session)
[4]  LDAP Search (Anonymous)
[5]  DNS Enumeration
[0]  Back to Main Menu

Requires a target; LDAP and DNS additionally require a domain.

---

[1] Nmap Scan

Service/version + default-script scan across the common AD ports.

nmap -p 88,135,139,389,445,464,636,3268,3269,5985 -sV -sC \
     -oA <output>/nmap_ad <target>

Those ports map to: Kerberos (88, 464), RPC endpoint mapper (135), NetBIOS (139), LDAP (389), SMB (445), LDAPS (636), Global Catalog (3268/3269) and WinRM (5985). Output is saved in all three Nmap formats: nmap_ad.nmap, nmap_ad.xml, nmap_ad.gnmap.

Use it first — the open ports tell you which of the following modules are worth running.

---

[2] enum4linux-ng

Modern SMB enumeration, users, groups, shares, password policy, OS info, all in one pass.

enum4linux-ng -A <target> | tee <output>/enum4linux-ng.txt

-A runs every check. Works anonymously against hosts that allow null/guest SMB sessions. This is usually the richest single source of passive AD data.

---

[3] RPC Client (Null Session)

Attempts an anonymous RPC session and enumerates server info, users and groups.

rpcclient -U "" -N <target>
  srvinfo
  enumdomusers
  enumdomgroups

Output saved to rpcclient.txt. Succeeds only where the DC permits null sessions (older or misconfigured environments). An empty result usually means null sessions are disabled, which is itself a finding.

---

[4] LDAP Search (Anonymous)

Anonymous LDAP query against the domain naming context.

ldapsearch -x -H ldap://<target> -b <base_dn> "(objectclass=*)" \
  | tee <output>/ldap.txt

The base DN is derived from the configured domain (corp.local → dc=corp,dc=local). Requires both target and domain. Many hardened DCs reject anonymous binds; if so you will get little back here and should revisit with credentials via Active Enumeration.

---

[5] DNS Enumeration

DNS reconnaissance against the domain using the target as the resolver.

dnsrecon -d <domain> -n <target> | tee <output>/dnsrecon.txt

Requires target and domain. Surfaces DNS records, SRV records (which reveal DCs, Global Catalogs, Kerberos/LDAP services) and any zone data the server is willing to give up.

---

Tips

• Run Nmap first, then only the modules whose ports are open.
• Empty results from RPC/LDAP are meaningful, they indicate the anonymous attack surface is closed.
• Everything is teed to the output directory as you go; review later with Special Actions → [4] View Results.
• For an all-in-one passive sweep, Special Actions → [1] Auto Workflow runs Nmap + enum4linux-ng + RPC + LDAP back to back. See Special Actions.