Information Gatheringldapenumerationactive-directorykrb5

LDeep

LDeep is an in-depth LDAP enumeration utility that runs against Active Directory LDAP servers or locally on saved files. It supports detailed data retrieval using various backend engines.

Description

LDeep serves as a specialized tool for comprehensive LDAP enumeration, targeting Active Directory environments. It enables security professionals to extract detailed directory information either directly from live LDAP servers or from previously saved cache files. This makes it valuable for reconnaissance and auditing tasks in Windows domain assessments.

Use cases include mapping Active Directory structures, identifying user accounts, groups, and permissions during penetration testing. The tool's ability to process protections and cache data enhances its utility for offline analysis, reducing the need for repeated network queries.

With a modest installed size of 251 KB, LDeep depends on several Python libraries and Kerberos components, ensuring robust handling of authentication and encryption protocols common in enterprise LDAP setups.

How It Works

LDeep operates by connecting to LDAP servers using the ldap3 library and related dependencies like python3-gssapi for Kerberos authentication. It supports three backend modes: 'ldap' for live server queries, 'cache' for processing saved files, and 'protections' for specific security data retrieval. Optional security descriptor fetching provides detailed access control information via the --security_desc flag.

Installation

bash

sudo apt install ldeep

Flags

-h, --helpshow this help message and exit

-o, --outfile OUTFILEStore the results in a file

--security_descEnable the retrieval of security descriptors in ldeep results

{ldap,cache,protections}Backend engine to retrieve data

Examples

Displays the full help message and usage information for LDeep

ldeep -h

Runs LDAP enumeration mode and saves output to results.txt

ldeep ldap -o results.txt

Processes cache files with security descriptor retrieval enabled

ldeep cache --security_desc

Uses protections backend mode for security-related data enumeration

ldeep protections

Enumerates live LDAP server and stores results in specified file

ldeep ldap --outfile /tmp/output.json

Analyzes saved cache with security descriptors output to file

ldeep cache -o analysis.json --security_desc

Updated 2026-04-16kali.org ↗