1. Sweep the subnet
On an authorized engagement, crackmapexec sweeps the SMB hosts to map the domain's reachable machines and shares.
crackmapexec smb 10.0.0.0/24Typorithm · hard
AD Enumeration
ad-enumpentestactive-directorybloodhoundldap
Saved on this device
Full lesson · 8 learning steps Open any exercise for focused practice
10%
Step 1 of 8 · intro card
Learn AD Enumeration
Active Directory
Most corporate tests center on Active Directory. With authorization, enumerate users, groups, shares, and trusts using crackmapexec and ldapsearch; BloodHound collects the data and graphs the shortest path to Domain Admin. The defensive control is tiering — segmenting admin access reduces the attack surface BloodHound can graph.
Active Directory is the backbone of most corporate networks, so authorized engagements almost always begin by mapping it. crackmapexec sweeps SMB hosts across a subnet, and ldapsearch reads the directory tree from the domain controller to enumerate users, groups, shares, and trusts.
BloodHound's ingestor (bloodhound-python -c all) collects relationships — group memberships, sessions, and ACLs — then graphs them. The graph reveals the shortest path from a low-privilege foothold to Domain Admin, which is exactly what a defender wants to see and close first.
The defensive control is a tiered administration model: separating Tier 0 (domain controllers, identity) from workstations and limiting where privileged accounts log in shrinks the attack surface. Fewer dangerous edges means BloodHound finds no easy path to Domain Admin.
01
crackmapexec + ldapsearch enumerate the domain.
02
BloodHound graphs the path to Domain Admin.
03
Defense: tiered admin shrinks the attack surface.
crackmapexec smb 10.0.0.0/24
bloodhound-python -d corp.local -u user -p pass -c all
ldapsearch -x -H ldap://dc -b "dc=corp,dc=local"
# BloodHound graphs the path to Domain AdminRead the implementation
Connect each part of the code to the concept before you type.
2. Collect graph data
The BloodHound ingestor (-c all) collects users, groups, sessions, and ACLs so the data can be graphed.
bloodhound-python -d corp.local -u user -p pass -c all3. Query the directory
ldapsearch reads the directory tree directly from the domain controller to enumerate objects.
ldapsearch -x -H ldap://dc -b "dc=corp,dc=local"4. Shortest path
BloodHound turns collected relationships into a graph and finds the shortest path to Domain Admin.
# BloodHound graphs the path to Domain AdminA complete learning loop
01
Understand
Read the concept map and follow the code breakdown.
02
Reconstruct
Type the implementation, repair mistakes and work through every recall exercise.
03
Verify
Use the final check without hints; revisit weak concepts in short practice sessions.