Active › Module 4 › Lesson 1
LDAP Ports
LDAP and related ports name AD query surfaces — document lab ports on $LAB_AD; defenders restrict and monitor binds.
Visual · t25_ldap_ports
LDAP port literacy. $LAB_AD only. Original Cyberlium.
Opening
Enum starts with knowing which ports answer — literacy before any collector runs.
LDAP 389/tcp (636/tcp LDAPS), Global Catalog 3268/3269, Kerberos 88, SMB 445, RPC dynamic/high — common AD service map. Signed/sealed LDAP and channel binding reduce relay and tampering risk. Defenders restrict anonymous binds and monitor query volume. Cyberlium documents port map for YOUR $LAB_AD DC — not port-scanning stranger DCs. Next: BloodHound Named.
1. Core AD ports (named)
389/636: LDAP/LDAPS directory queries. 3268/3269: Global Catalog. 88: Kerberos. 445: SMB (SYSVOL, shares). 135 + dynamic RPC: remote admin interfaces — restrict in production.
On $LAB_AD, table DC IP with these ports and note whether LDAPS is required in lab — observation from YOUR scope only.
Command guide
Try these commands — Core AD ports (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
LDAP ports — https://learn.microsoft.com/en-us/windows/win32/ad/active-directory-domain-services (389/636 literacy) Microsoft AD ports — https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/active-directory-ldap-over-ssl (LDAPS 636) Nmap LDAP — https://nmap.org/nsedoc/scripts/ldap-rootdse.html (rootDSE literacy — lab only)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install nmap sudo apt install curl
macOS:
Command — copy this
brew install nmap
Windows:
Command — copy this
choco install nmap # or download https://nmap.org/download.html
Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
source "$HOME/cyberlium-lab/t25-ad/lab.env" 2>/dev/null || export LAB_AD_HOST=${LAB_AD_HOST:-127.0.0.1}AD port triage on YOUR lab DC — 53 DNS, 88 Kerberos, 389 LDAP, 636 LDAPS, 445 SMB, 3389 RDP
Command — copy this
nmap -Pn -p 53,88,389,636,445,3389 "$LAB_AD_HOST" 2>/dev/null | grep -E 'PORT|open|53|88|389|636|445|3389' | head -12 curl -sS https://learn.microsoft.com/en-us/windows/win32/ad/active-directory-domain-services | head -6
Primary tools to practice this lesson: nmap, curl. Reference sites: LDAP ports (https://learn.microsoft.com/en-us/windows/win32/ad/active-directory-domain-services); Microsoft AD ports (https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/active-directory-ldap-over-ssl); Nmap LDAP (https://nmap.org/nsedoc/scripts/ldap-rootdse.html). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Signed LDAP and channel binding (defender)
LDAP signing and sealing integrity-protects directory traffic. Channel binding mitigates some relay classes. GPO and domain controller settings enforce requirements — defenders audit non-compliant clients.
Literacy: unsigned LDAP from untrusted networks is a finding — fix with signing requirements, not unauthorized scanning.
3. Literacy ≠ stranger port scan
Forbidden: nmap LDAP against corporate DC ranges without authorization. Allowed: port table for $LAB_AD DC with defender hardening note per port.
Ship: LDAP port card — five ports, purpose, one hardening sentence. Next: BloodHound Named.
4. What you ship: AD port map for $LAB_AD
Five-port table with purposes and hardening notes. $LAB_AD DC IP. NO stranger scans. chmod 600.
5. What you record before the next lesson
Date. Port map. $LAB_AD named. File t25-m04-l01-ldap-ports.txt chmod 600.
6. Wrong vs right: stranger-domain attacks vs lab AD literacy
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Port-scan campus AD ranges. Disable LDAP signing globally to 'ease enum.'
Right
Write port map for YOUR $LAB_AD DC with hardening notes. Next: BloodHound Named.
Mission: document YOUR lab AD ports
1) List LDAP, LDAPS, GC, Kerberos, SMB ports. 2) One-line purpose each. 3) Note LDAP signing defender habit. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
LDAPS 636 should be default for sensitive queries outside lab VLAN.
Knowledge Check
APPLY: LDAP port literacy means:
Multiple choice
Knowledge Check
APPLY: True or False: LDAP commonly uses port 389 and LDAPS 636.
True or False
Knowledge Check
APPLY: LDAP signing primarily helps:
Multiple choice