Internal Network Reconnaissance & SMB/LDAP Enumeration Lab
Documented offensive enumeration workflows across SMB, LDAP, and RPC services while capturing corresponding network signatures in Wireshark and Suricata.
Unauthenticated LDAP reconnaissance, SMB null session enumeration, and relay-vulnerable host discovery.
Inspected SMB2 tree connect spikes and high-volume LDAP search requests over TCP/389 in Suricata.
Documented remediation checklists enforcing SMB signing, disabling NTLMv1, and restricting anonymous directory queries.
Case Study & Technical Notes
Built a multi-subnet virtual network to practice structured internal penetration testing methodology aligned with eCPPT and CPTS objectives. Conducted service discovery, SMB signing checks, anonymous LDAP binds, and share enumeration using Nmap, NetExec, and Enum4linux-ng, then inspected the resulting packet captures to write network detection signatures.
nxc smb 10.10.10.0/24 --gen-relay-list relay_targets.txt
ldapsearch -x -H ldap://10.10.10.5 -b "DC=corp,DC=local"