Penetration › Module 7 › Lesson 2
Enum Concepts
AD enumeration concepts on YOUR $LAB_AD — users, groups, sessions literacy without stranger-domain cookbooks.
Visual · t19_enum_concepts
AD enum = discover users, groups, ACLs, sessions in scope. $LAB_AD only. Original Cyberlium.
Opening
Enumeration maps the lab forest you built — not a shortcut through someone else's domain.
AD enumeration concepts include listing users and groups, identifying high-value accounts (naming only), session and share visibility, ACL/permission literacy, and graph tools (BloodHound named as concept) to understand attack paths in YOUR $LAB_AD. Learn what defenders log: LDAP queries, Kerberos traffic, unusual bind patterns. Cyberlium teaches enumeration goals and tool categories at literacy level on lab AD — not full step-by-step domain takeover recipes for stranger orgs. RoE lists allowed hosts in $LAB_AD only; stop at lab boundary VLAN.
1. Enumeration goals
Map users/groups/computers, find excessive privileges, identify lateral paths — on $LAB_AD per brief.
Output feeds report findings — not live ops on production strangers.
Command guide
Try these commands — Enumeration goals
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
LDAP port 389 — scan $LAB_HOST only AD recon literacy — lab domain controller YOU own
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install dnsutils sudo apt install nmap
macOS:
Command — copy this
brew install bind brew install nmap
Windows: Built-in: nslookup (or install BIND for dig)
Command — copy this
choco install nmap # or download https://nmap.org/download.html
═══ LINUX / macOS ═══
Command — copy this
source "$HOME/cyberlium-lab/t19-lab.env" nmap -p 389,636 "$LAB_HOST" dig +short "$LAB_HOST" 2>/dev/null || dig @127.0.0.1 version.bind chaos txt +short 2>/dev/null || echo 'LDAP/dig literacy on LAB_HOST only'
Primary tools to practice this lesson: dig, nmap. Reference sites: LDAP port 389; AD recon literacy. Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Tool literacy (named)
LDAP queries, net commands, PowerView/BloodHound categories — run only on $LAB_AD when brief allows.
Read tool descriptions; understand data touched — no importing stranger BloodHound zip files from the internet.
3. Defender visibility
Monitor LDAP/Kerberos anomalies, honeypot accounts, tiered admin, limited interactive logons for service accounts.
Enumeration noise is a detection opportunity — note what SIEM rule would fire in lab notes.
4. What you ship: AD enum concept map
Three enum goals + two defender detections + $LAB_AD-only scope.
5. What you record before the next lesson
AD enum concept notes path.
6. Wrong vs right: stranger nets vs YOUR lab VMs
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Import BloodHound data from a leaked enterprise dump 'for practice.'
Right
Name AD enum goals and defenses. Next: Auth Abuse Named.
Mission: AD enum concepts
1) List three enum goals on $LAB_AD. 2) Name BloodHound as path-graph literacy. 3) Write two defender detections. 4) Write NEVER stranger domain enum.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “LDAP vs Kerberos enum — defender log difference?”
Knowledge Check
APPLY: AD enumeration on Cyberlium:
Multiple choice
Knowledge Check
APPLY: True or False: Stranger BloodHound imports are lab material.
True or False
Knowledge Check
APPLY: Defenders detect AD enum via:
Multiple choice