LDAP Enumeration with Anonymous Bind
During a penetration test, you discover an LDAP server on port 389 that allows anonymous binds. Which of the following enumeration techniques would provide the MOST comprehensive information about the directory structure?
Quick Answer
The answer is to use ldapsearch to query the directory for all attributes. This is correct because when an LDAP server on port 389 permits anonymous binds, it effectively grants unauthenticated read access to the entire directory tree, allowing ldapsearch to retrieve comprehensive information including user accounts, groups, organizational units, and all associated attributes. On the Certified Ethical Hacker CEH exam, this scenario tests your understanding of LDAP enumeration with anonymous bind as a critical reconnaissance technique, often appearing in questions about service misconfigurations and information gathering. A common trap is assuming you need credentials or only specific base DNs, but anonymous bind bypasses authentication entirely. Memory tip: think of “anonymous bind” as an open book—ldapsearch flips through every page, revealing the full directory structure without needing a library card.
⚠ Common exam trap
Many candidates confuse LDAP enumeration with SMB or DNS enumeration, assuming any network discovery tool will work, but only LDAP-specific queries (like `ldapsearch`) can extract directory structure from an LDAP server.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use ldapsearch to query the directory for all attributes
`ldapsearch` with anonymous bind allows querying the LDAP directory for all attributes and entries, providing comprehensive information about the directory structure, including user accounts, groups, organizational units, and other objects. LDAP servers on port 389 often expose the entire directory tree when anonymous binds are permitted, making `ldapsearch` the most effective enumeration technique.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Run nmap with the smb-enum-shares script
Why it's wrong here
SMB enumeration is for Windows file sharing, not LDAP directory services.
- ✗
Perform a DNS zone transfer
Why it's wrong here
DNS zone transfer reveals DNS records, not LDAP directory structure.
- ✓
Use ldapsearch to query the directory for all attributes
Why this is correct
ldapsearch can retrieve all objects and attributes from an LDAP directory, especially with anonymous bind.
- ✗
Use net view to list domain resources
Why it's wrong here
net view is a Windows command that lists shared resources on the network, not LDAP directory information.
Go deeper
Related to this question
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on CEH
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. During a penetration test, the tester runs `ldapsearch -x -H ldap://192.168.1.20 -b 'dc=domain,dc=com' '(objectclass=*)'`. The output reveals user objects with 'userPassword' attributes in clear text. Which type of enumeration is being performed, and what is the security implication?
hard- A.NFS enumeration; it indicates that NFS shares are world-readable
- ✓ B.LDAP enumeration; it indicates that the LDAP server stores passwords in plaintext, posing a credential theft risk
- C.SNMP enumeration; it indicates that the community string is weak
- D.SMTP enumeration; it indicates that the mail server is misconfigured
Why B: The `ldapsearch` command is used to query an LDAP directory service. The option `-x` specifies simple authentication, and the filter `(objectclass=*)` retrieves all entries. The output revealing `userPassword` attributes in clear text indicates that the LDAP server is storing passwords in plaintext, which is a severe security risk because an attacker can directly harvest credentials for lateral movement or privilege escalation.
Variation 2. During a penetration test, you need to enumerate all users and groups from a Windows domain controller. Which tool is BEST suited for this task?
medium- ✓ A.ldapsearch
- B.nbtstat
- C.smbclient
- D.snmpwalk
Why A: ldapsearch is the best tool for enumerating users and groups from a Windows domain controller because it directly queries the Active Directory LDAP directory service (port 389 or 636 for LDAPS) using standard LDAP search filters. This allows retrieval of all user and group objects, including their attributes, without relying on NetBIOS or SMB file sharing. It is the most efficient and comprehensive method for structured directory enumeration in a domain environment.
Variation 3. A penetration tester wants to enumerate users and groups from a Windows domain controller via LDAP without logging in. Which of the following tools is MOST appropriate for anonymous LDAP enumeration?
medium- A.smbclient
- ✓ B.ldapsearch
- C.snmpwalk
- D.enum4linux
Why B: ldapsearch is the correct tool because it can perform anonymous LDAP queries against a Windows domain controller's LDAP service (port 389) without requiring authentication. By default, many Windows DCs allow anonymous binds to retrieve directory information such as user and group objects, making ldapsearch the most direct and appropriate choice for this task.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.