id: ldap-metadata

info:
  name: LDAP Metadata - Enumeration
  author: pussycat0x
  severity: info
  description: |
    LDAP metadata refers to the data that describes the structure, schema, and attributes of the LDAP directory
  reference:
    - https://docs.projectdiscovery.io/templates/protocols/javascript/modules/ldap.Metadata
  metadata:
    max-request: 1
    shodan-query: ldap
  tags: js,network,ldap,discovery

javascript:
  - code: |
      const ldap = require('nuclei/ldap');
      const cfg = new ldap.Config();
      cfg.Upgrade = true;
      const client = new ldap.Client(Host, Port);
      const metadata = client.CollectMetadata();
      Export((metadata))

    args:
      Host: "ldap://{{Host}}"
      Port: 389

    matchers:
      - type: dsl
        dsl:
          - "len(BaseDn) != 0"
          - "len(DnsHostName) != 0"
          - "len(DefaultNamingContext) != 0"
          - "len(DomainFunctionality) != 0"
          - "len(ForestFunctionality) != 0"
          - "len(DomainControllerFunctionality) != 0"
          - "success == true"

    extractors:
      - type: json
        internal: true
        name: BaseDn
        json:
          - '.BaseDN'

      - type: json
        internal: true
        name: DnsHostName
        json:
          - '.DnsHostName'

      - type: json
        internal: true
        name: DefaultNamingContext
        json:
          - '.DefaultNamingContext'

      - type: json
        internal: true
        name: DomainFunctionality
        json:
          - '.DomainFunctionality'

      - type: json
        internal: true
        name: ForestFunctionality
        json:
          - '.ForestFunctionality'

      - type: json
        internal: true
        name: DomainControllerFunctionality
        json:
          - '.DomainControllerFunctionality'

      - type: json
        json:
          - '"BaseDN: " + .BaseDN'
          - '"DnsHostName: " + .DnsHostName'
          - '"DefaultNamingContext: "+ .DefaultNamingContext'
          - '"DomainFunctionality: "+ .DomainFunctionality'
          - '"ForestFunctionality: " + .ForestFunctionality'
          - '"DomainControllerFunctionality: "+ .DomainControllerFunctionality'
# digest: 4a0a00473045022100fb81418a17542cdde195df6a7197af11cedf7efad6c62b7b65acc235913fe17102206774462282af9d8f9c468498c13d6ab5bbc7eed49504bbfb459b1d0d789a0f22:922c64590222798bb761d5b6d8e72950