Repository files navigation

Monitor creation, deletion and changes to LDAP objects live during your pentest or system administration!

With this tool you can quickly see if your attack worked and if it changed LDAP attributes of the target object.

Here is a few use cases where this tool can be useful:

• Detect account lockout in real time

• Check if your privilege escalation worked (with ntlmrelay's--escalate-user option)

• Detect when users are login in to know when to start a network poisoning.

LDAP paged queries returnspageSize results per page, and it takes approximately 1 second to query a page. Therefore your monitoring refresh rate is(number of LDAP objects // pageSize) seconds. On most domain controllerspageSize = 5000.

Pull requests are welcome. Feel free to open an issue if you want to add other features.