LDAP is the directory query protocol we use to ask Active Directory about users, groups, computers, ACL-relevant attributes, delegation, SPNs, deleted objects, and configuration data. The boring protocol details matter only enough to choose the right endpoint, bind method, base DN, paging, and TLS mode before running the real queries.
Tooling used throughout this section includes: NetExec, Impacket, PowerView, windapsearch, Certipy, pyWhisker, PKINITtools, Hashcat, and Apache Directory Studio.
Use ldap:// with -ZZ or ldaps:// when sending credentials. Use paging by default because AD commonly limits LDAP search responses to 1000 objects.