Enumeration tools
The most common tools used for domain enumeration are PowerView or SharpView and SharpHound together with BloodHound.
SharpView/PowerView
SharpView[10] is a .NET port of PowerView[11]. This tool has a wide variety of methods that can improve and speed up the enumeration process in complex environments. I can recommend reading the PowerView wiki[12], as it explains in detail how the tool runs queries. Let us grab the version from GitHub, compile it, and follow our methodology. We will not run Wireshark for every command, but choose one as an example to understand what traces are left behind us. To make our life easier, I used the Get-DomainSID command:
Figure 3.10 – Result of the Get-DomainSID command
The following Wireshark capture shows a few DNS requests for the domain LDAP SRV, then a mix of CLDAP and LDAP queries/responses, together with Kerberos authentication. Overall, 265 packets were captured:
