LDAP Browser¶

Active Directory reconnaissance through beacon LDAP relay. The LDAP Browser allows operators to execute arbitrary LDAP queries against domain controllers using a beacon's authenticated session -- no direct network access from the operator workstation is required.

All queries are dispatched as discovery tasks to the selected beacon, which performs the LDAP bind and search using its current security context. Results are returned through the normal task polling pipeline and rendered in the UI.

Architecture¶

sequenceDiagram
    participant Operator as Operator UI
    participant API as Stentor API
    participant Queue as Task Queue
    participant Beacon as Beacon (Windows)
    participant DC as Domain Controller

    Operator->>API: POST /cockpit/ldap/query
    API->>Queue: Enqueue discovery task (ldap_query)
    API-->>Operator: {task_id, status: "queued"}
    Beacon->>Queue: Poll for tasks
    Queue-->>Beacon: ldap_query task
    Beacon->>DC: LDAP search (authenticated bind)
    DC-->>Beacon: LDAP result entries
    Beacon->>API: Submit task result
    Operator->>API: Poll GET /cockpit/beacons/:id/tasks
    API-->>Operator: Completed task with LDAPQueryResult

UI Overview¶

The LDAP Browser page (/ldap) provides a three-tab interface:

Beacon Selector¶

A dropdown at the top of the page lists all active Windows beacons. Each entry shows the hostname, username, and IP address. Selecting a beacon sets it as the target for all subsequent queries.

Result Table¶

Query results are displayed as a table with columns for each requested attribute. The result includes metadata:

Execute LDAP Query¶

POST /api/v1/cockpit/ldap/query¶

Enqueue an LDAP query task to a beacon. The beacon executes the query against its reachable domain controller and returns the results through the task pipeline.

Request body:

Example -- enumerate all domain computers:

curl -s -X POST https://stentor.app/api/v1/cockpit/ldap/query \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "beacon_id": "BEACON_UUID",
    "base_dn": "DC=corp,DC=local",
    "filter": "(objectCategory=computer)",
    "attributes": ["sAMAccountName", "dNSHostName", "operatingSystem", "lastLogonTimestamp"],
    "scope": "subtree",
    "max_results": 500
  }'

Response:

{
  "task_id": "d4f8e2a1-...",
  "beacon_id": "BEACON_UUID",
  "status": "queued"
}

The result is retrieved by polling the beacon's task list (GET /api/v1/cockpit/beacons/:beacon_id/tasks) until the task status changes to completed. The task output contains the LDAPQueryResult JSON.

LDAP Filter Syntax¶

Stentor passes filters directly to the domain controller's LDAP implementation. Standard RFC 4515 filter syntax is supported.

Search Scope¶

The Browse tab uses onelevel scope to expand tree nodes one level at a time, querying with (objectClass=*) and requesting the objectClass, name, and description attributes.

Pre-built Query Templates¶

GET /api/v1/cockpit/ldap/templates¶

Returns the static set of pre-built LDAP query templates. Templates are cached in the UI for 10 minutes.

curl -s https://stentor.app/api/v1/cockpit/ldap/templates \
  -H "Authorization: Bearer $TOKEN"

Template response fields:

Available Templates¶

OPSEC Considerations¶