Function parse_arguments

NetworkHound.py:70–160

Parse command line arguments

()

    # ldap3 logging removed

def parse_arguments():
    """Parse command line arguments"""
    parser = argparse.ArgumentParser(
        description='Query Domain Controller for computer information and generate OpenGraph JSON',
        epilog='''
Examples:
  # Basic LDAP scan (password)
  %(prog)s --dc 10.0.0.5 --domain corp.local --user administrator --password 'P@ssw0rd' --output corporate_topology.json
  
  # Full scan: enable port scanning, HTTP + SMB validation and SSL certificate extraction
  %(prog)s --dc dc.corp.local --domain corp.local --user admin --password 'P@ss' --port-scan --valid-http --valid-smb --ssl --verbose
  
  # Use NTLM hashes instead of password (Impacket style LM:NT or NT-only)
  %(prog)s --dc 10.1.1.10 --domain corp.local --user svc_account --hashes LMHASH:NTLMHASH --port-scan --valid-smb
  
  # Use Kerberos (requires KRB5CCNAME pointing to a ccache file)
  export KRB5CCNAME=./admin.ccache
  %(prog)s --dc dc.corp.local --domain corp.local --user admin -k --port-scan --valid-http
  
  # Manual network-only scan (CIDR, ranges and single IPs) - skip ping checks (-Pn)
  %(prog)s --networks "192.168.1.0/24,10.0.1.1-10.0.1.50,172.16.5.10" -Pn --port-scan --ports 22,80,443 --scan-threads 50
  
  # Manual IP-range scan with custom DNS server and specific ports
  %(prog)s --networks "192.168.2.1-192.168.2.200" --dns 8.8.8.8 --ports 80,443,8080 --scan-timeout 5 --output web_scope.json
  
  # DNS over TCP (useful for proxy/firewall bypass)
  %(prog)s --dc dc.corp.local --domain corp.local --user admin --password 'P@ss' --dns 8.8.8.8 --dns-tcp --verbose
  
  # Via proxychains with DNS over TCP
  proxychains %(prog)s --dc dc.corp.local --domain corp.local --user admin --password 'P@ss' --dns-tcp --port-scan
  
  # Shadow-IT sweep across subnets (find non-domain devices)
  %(prog)s --dc dc.corp.local --domain corp.local --user auditor --password 'Audit123' --shadow-it --port-scan --verbose
        ''',
        formatter_class=argparse.RawDescriptionHelpFormatter
    )
    
    # LDAP connection options (optional when using --networks)
    parser.add_argument('--dc', help='Domain Controller hostname or IP address')
    parser.add_argument('--domain', '-d', default='auto', help='Domain name (e.g., company.local) (use "auto" to extract from Kerberos ticket)')
    parser.add_argument('--user', '-u', '--username', default='auto', help='Username for LDAP authentication (use "auto" to extract from Kerberos ticket)')
    parser.add_argument('--password', '-p', help='Password for LDAP authentication')
    
    # Impacket-style authentication options
    parser.add_argument('--hashes', help='NTLM hashes in LM:NT format (or NT-only 32-hex) to use instead of password')
    parser.add_argument('-k', '--kerberos', action='store_true', help='Use Kerberos authentication (uses KRB5CCNAME environment variable)')
    # ldap3 removed - using only impacket
    
    # Manual network specification (alternative to LDAP)
    parser.add_argument('--networks', '-N', help='Comma-separated list of networks to scan. Supports: CIDR (192.168.1.0/24), IP ranges (192.168.1.1-192.168.1.50), single IPs (172.16.1.10)')
    parser.add_argument('--dns', help='DNS server for ADIDNS queries (defaults to DC if not specified)')
    parser.add_argument('--dns-tcp', action='store_true', help='Use TCP for DNS queries instead of UDP (useful for DNS over proxy/firewall)')
    parser.add_argument('--output', '-o', default='network_opengraph.json', help='Output JSON file (default: network_opengraph.json)')
    parser.add_argument('-Pn', action='store_true', help='Skip ping check, treat all hosts as online (same as nmap -Pn)')
    parser.add_argument('--verbose', '-v', action='store_true', help='Enable verbose output with detailed resolution methods')
    parser.add_argument('--port-scan', action='store_true', help='Enable TCP port scanning')
    parser.add_argument('--ports', default='21,22,23,25,53,80,81,110,119,123,135,137,139,143,264,389,443,445,554,636,1433,1434,3306,3389,5060,5061,5222,5800,5801,5900,5901,5985,5986,8009,8080,8443,9200,44443', 
                       help='Comma-separated list of ports to scan (default: common ports)')