• Ports: ldap 389/tcp ldaps 636/tcp globalldap/globalcatldap 3268/tcp globalldaps/globalcatldapssl 3269/tcp Enumerate without credentials Nmap enu­mer­a­tion scans nmap -n -sV --script "ldap* and not brute" $target Ldapsearch scan ldapsearch -x -h $target -D '' -w '' -b "DC=BLA,DC=local" Con­nect to LDAPs/GlobalLDAPs: openssl s_client -connect $target:636 </dev/null openssl s_client -connect $target:3269 </dev/null Search in the directory: ldapsearch -x -b…

  • Note that FTP does­n’t show hid­den files! Try in Win­dows e.g “cd ProgramData”. Enumeration With nmap. Scans a net­work for ftp servers which allow anony­mous access. nmap -v -p21 --script=ftp-anon.nse 10.11.1.1-254 FTP relays The FTP spec­i­fi­ca­tion defines FTP relays. One FTP serv­er can say to anoth­er FTP serv­er to send files to anoth­er third-par­ty serv­er.…