Version detection probe - LDAPSearchReqUDP #354

wants to merge 5 commits into


None yet

2 participants


This PR adds a new version detection probe and matchlines to detect Microsoft implementation of Connectionless LDAP (LDAP over UDP). This is used on Active Directory controllers. The request effectively consists of an LDAP query with an empty baseDN and a filter of objectClass = *. The result allows us to to determine target hostname, Active Directory name ( FQDN not NetBIOS name), and the Active Directory site that the host is located in.

The traffic seen in the probe and matchlines can be replicated by using the Microsoft ldp.exe application to make a Connectionless request to an Active Directory Controller on port 389 without SSL.

Here is an example of the output from a scan.

389/udp open  ldap    Microsoft Windows Active Directory ldap (Domain: DemoDomain.labdom, Site: Default-First-Site-Name)
Service Info: Host: DEMOADC; OS: Windows

This has been verified with Active Directory controllers from Windows Server 2008 to Server 2012 R2.
I have tested with non-Microsoft LDAP implementations and I have not seen this service used anywhere else or that will respond to this probe.

EDIT: I've also added an entry to nmap-payloads to enable port status discovery.


TomSellers added some commits Apr 3, 2016
@TomSellers TomSellers Probe LDAPSearchReqUDP
Add a new probe for connectionless LDAP ( CLDAP ) used by Active
Directory for certain operations.  The service functions on 389/udp
@TomSellers TomSellers Type 53fab9c
@TomSellers TomSellers Add a UDP Payload for CLDAP to nmap-payloads 3e76a1b

@bonsaiviking I will be adding to this PR as this probe works well for TCP ldap services as well and generates useful data. I should have this complete and committed to SVN tonight.

Example against VMware vCenter

389/tcp open  ldap    syn-ack ttl 60 VMware vCenter or PSC ldap PSCv 6.0.0
Service Info: Host: testvcenter

Would this be appropriate as a UDP scanning payload in nmap-payloads? Requirements there are similar to those for service scan probes: must not cause disruption, should result in some sort of response from the server.

As a follow-up: is this a potential DDoS reflector? How big/how many packets are the responses to this sort of probe, and how do they scale?


I added the scanning payload to nmap-payloads in this PR yesterday but it wasn't in the original PR changes. As far as DDoS, the only place if have seen the UDP version of LDAP was on Microsoft Active Directory controllers. It is my sincere hope that there aren't a significant number of those on the Internet, but...

The sending packet for the objectClass = * query is 93 bytes. The standard response is a single packet that varies in size depending on the domain but is generally between 1200 and 1400 bytes.


Also, I've nearly completed adding the UDP searchRequest to ldap.lua so that scripts like ldap-rootdse can be modified to use it. I've successfully modified ldap-rootdse to make it work. I just need to refactor the code a bit and clean up.

@nmap-bot nmap-bot pushed a commit that closed this pull request Apr 5, 2016
tomsellers Add new version detection Probes for LDAP services, LDAPSearchReq
and LDAPSearchReqUDP. The second is Microsoft Active Directory specific.
Both, when used against AD, return the same information.  This commit
also adds an nmap-payload entry for detecting LDAP on udp. Closes #354
@nmap-bot nmap-bot closed this in af4b459 Apr 5, 2016
@TomSellers TomSellers deleted the unknown repository branch Apr 5, 2016
@TomSellers TomSellers restored the unknown repository branch Apr 5, 2016
@TomSellers TomSellers deleted the unknown repository branch Apr 5, 2016
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment