ldapnomnom

ldapnomnom (lkarlslund) anonymously bruteforces valid Active Directory usernames at very high speed by abusing cLDAP LDAP Ping (Netlogon) requests against Domain Controllers. Because a valid name produces a different response than an invalid one, existence can be confirmed without authenticating - so there are no failed logons and no account lockouts, making it far quieter than Kerberos pre-auth enumeration. Feed it a wordlist with --input and it writes the valid names to --output; --dnsdomain lets it auto-discover DCs via DNS. Ideal for pre-credential recon. Command Reference: No_Creds Username wordlist: usernames.txt Output file: output.txt Domain: test.local

# Anonymous, lockout-free username validation via cLDAP LDAP Ping; DCs auto-discovered from DNS
ldapnomnom --input usernames.txt --output output.txt --dnsdomain test.local

Evidence

Upstream reference

Environment

Active Directory

Native

Enumeration, Discovery

MITRE

T1087.002

Requires

No credentials

Services

LDAP, Kerberos

Refs

github.com/lkarlslund/ldapnomnom

attack.mitre.org/techniques/T1087/002/