godap

A complete terminal user interface (TUI) for LDAP.

<img src="https://img.shields.io/github/v/release/Macmod/godap" alt="GitHub Release">
<img src="https://img.shields.io/github/go-mod/go-version/Macmod/godap" alt="">
<img src="https://img.shields.io/github/languages/code-size/Macmod/godap" alt="">
<img src="https://img.shields.io/github/license/Macmod/godap" alt="">
<img src="https://img.shields.io/github/actions/workflow/status/Macmod/godap/release.yml" alt="">
<a href="https://goreportcard.com/report/github.com/Macmod/godap/v2"><img src="https://goreportcard.com/badge/github.com/Macmod/godap/v2" alt="Go Report Card"></a>
<img src="https://img.shields.io/github/downloads/Macmod/godap/total" alt="GitHub Downloads">
<a href="https://twitter.com/MacmodSec"><img src="https://img.shields.io/twitter/follow/MacmodSec?style=for-the-badge&logo=X&color=blue" alt="Twitter Follow"></a>

Summary

• Features
• Installation
• Usage
• Flags
• Keybindings
• Tree Colors
• Contributing
• Acknowledgements
• Disclaimers

Features

• 🧩 Supports authentication with password, NTLM hash, Kerberos ticket or PEM/PKCS#12 certificate
• 🗒️ Formats date/time, boolean and other categorical attributes into readable text
• 😎 Pretty colors & cool emojis
• 🔐 LDAPS & StartTLS support
• ⏩ Fast explorer that loads objects on demand
• 🔎 Recursive object search bundled with useful saved searches
• 👥 Flexible group members & user groups lookups
• 🎡 Supports creation, editing and removal of objects and attributes
• 🚙 Supports moving and renaming objects
• 🗑️ Supports searching deleted & recycled objects
• 📁 Supports exporting specific subtrees of the directory into JSON files
• 🕹️ Interactive userAccountControl editor
• 🔥 Interactive DACL viewer + editor
• 🌐 Interactive ADIDNS viewer + editor (basic)
• 📜 GPO Viewer
• 🧦 SOCKS support

Installation

$ git clone https://github.com/Macmod/godap
$ cd godap
$ go install .

Package Repositories

Some members of the community have published godap in package repositories. The following packages are known to provide working releases of godap:

• Homebrew. godap by harpchad
• Alpine Linux (community). godap by omni+alpine@hack.org
• Arch Linux (AUR). godap-bin by killab33z

Remember to check godap's version before using these packages, as some of them might not always be up to date. In case you need the latest features, godap also provides automated releases for several platforms.

Usage

Bind with username and password

$ godap <hostname or IP> -u <username> -p <password> -d <domain>

or

$ godap <hostname or IP> -u <username>@<domain> -p <password>

Bind with an NTLM hash

$ godap <hostname or IP> -u <username> -H <hash> [-d <domain>]

Bind with a Kerberos ticket

$ KRB5CCNAME=ticket.ccache godap <hostname or IP> -k -d <domain> -t ldap/<DC hostname>

Bind with a Certificate + Private Key

PEM:

$ godap <hostname or IP> --crt <cert.pem> --key <cert.key> -I

PKCS#12:

$ godap <hostname or IP> --pfx <cert.pfx> -I

Note. This method will either pass the certificate directly when connecting with LDAPS (-S), or upgrade the unencrypted LDAP connection implicitly with StartTLS, therefore you must provide -I if you want to use it and your server certificate is not trusted by your client.

Anonymous Bind

$ godap <hostname or IP>

LDAPS/StartTLS

To use LDAPS for the initial connection (ignoring certificate validation) run:

$ godap <hostname or IP> [bind flags] -S -I

To use StartTLS to upgrade an existing connection to use TLS, use the Ctrl + u keybinding inside godap.

Notice that, if the server certificate is not trusted by your client, you must either have started godap with -I to use the upgrade command properly or toggle the IgnoreCert checkbox using the l keybinding before upgrading.

If LDAPS is available, you can also change the port using l, toggle the LDAPS checkbox, set the desired value for IgnoreCert, and reconnect with Ctrl + r.

SOCKS

To connect to LDAP through a SOCKS proxy include the flag -x schema://ip:port, where schema is one of socks4, socks4a or socks5.

You can also change the address of your proxy using the l keybinding.

For more usage information & examples check the Wiki

Flags

• -u,--username - Username for bind
• -p,--password - Password for bind
• --passfile - Path to a file containing the password for bind (or - for stdin)
• -P,--port - Custom port for the connection (default: 389 or 636 when -S is provided)
• -r,--rootDN <distinguishedName> - Initial root DN (default: automatic)
• -f,--filter <search filter> - Initial LDAP search filter (default: (objectClass=*))
• -b,--backend - Flavor of the LDAP server (msad, basic or auto)
• -E,--emojis - Prefix objects with emojis (default: true, to change use -emojis=false)
• -C,--colors - Colorize objects (default: true, to change use -colors=false)
• -A,--expand - Expand multi-value attributes (default: true, to change use -expand=false)
• -L,--limit - Number of attribute values to render for multi-value attributes when -expand is true (default: 20)
• -F,--format - Format attributes into human-readable values (default: true, to change use -format=false)
• -M,--cache - Keep loaded entries in memory while the program is open and don't query them again (default: true)
• -D,--deleted - Include deleted objects in all queries performed (default: false)
• -T,--timeout - Timeout for LDAP connections in seconds (default: 10)
• -I,--insecure - Skip TLS verification for LDAPS/StartTLS (default: false)
• -S,--ldaps - Use LDAPS for initial connection (default: false)
• -G,--paging - Paging size for regular queries (default: 800)
• -d,--domain - Domain name for NTLM / Kerberos authentication
• -H,--hash - Hashes for NTLM bind
• -k,--kerberos - Use Kerberos ticket for authentication (CCACHE specified via KRB5CCNAME environment variable)
• -t,--spn - Target SPN to use for Kerberos bind (usually ldap/dchostname)
• --hashfile - Path to a file containing the hashes for NTLM bind (or - for stdin)
• -x,--socks - URI of SOCKS proxy to use for connection (supports socks4://, socks4a:// or socks5:// schemas)
• -s,--schema - Load GUIDs from schema on initialization (default: false)
• --kdc - Address of the KDC to use with Kerberos authentication (optional: only if the KDC differs from the specified LDAP server)
• --timefmt - Time format for LDAP timestamps. Options: eu, us, iso8601, or define your own using go time format (default: eu)
• --attrsort - Sort attributes by name: none (default), asc (ascending), or desc (descending)
• --crt - Path to a file containing the certificate to use for the bind
• --key - Path to a file containing the private key to use for the bind
• --pfx - Path to a file containing the PKCS#12 certificate to use for the bind
• --exportdir - Custom directory to save godap exports taken with Ctrl+S (defaults to data)
• --offset - Custom time offset (in hours) to apply to formatted timestamps (useful when the DCs are not properly synchronized to UTC)

Keybindings