FIPAsec

FreeIPA Penetration Testing Tools

A comprehensive collection of tools and commands for conducting effective FreeIPA penetration tests.

Nmap
Network scanning and service detection

Installation

sudo apt install nmap (Debian/Ubuntu)
sudo yum install nmap (RHEL/CentOS)
brew install nmap (macOS)

Basic FreeIPA Port Scan

nmap -sV -p 80,443,389,636,88,464,53,123,749 <target_ip>

Scans common FreeIPA ports with service version detection.

Network Range Scan for FreeIPA

nmap -p 389,636,88,464 --open -oA freeipa_scan 192.168.1.0/24

Scans a network range for hosts with FreeIPA-related ports open.

LDAP Script Scan

nmap -p 389,636 --script="ldap* and not brute" <target_ip>

Runs LDAP-specific Nmap scripts to gather information about the LDAP server.

SSL/TLS Configuration Scan

nmap --script ssl-enum-ciphers -p 443,636 <target_ip>

Checks for weak SSL/TLS configurations on HTTPS and LDAPS ports.

Output Interpretation

Look for the following services which indicate a potential FreeIPA server:

  • Port 389/636: LDAP/LDAPS (389 Directory Server)
  • Port 88/464: Kerberos authentication/password change
  • Port 80/443: HTTP/HTTPS (FreeIPA Web UI)
  • Port 53: DNS
  • Port 749: Kerberos administration
DNS Enumeration Tools
Gathering information from DNS

Dig

dig SRV _ldap._tcp.example.com
dig SRV _kerberos._tcp.example.com
dig SRV _kpasswd._tcp.example.com

Queries DNS SRV records to find LDAP, Kerberos, and Kerberos password change services.

Zone Transfer Attempt

dig axfr example.com @ns1.example.com

Attempts a zone transfer to retrieve all DNS records for a domain.

DNSRecon

dnsrecon -d example.com -t std
dnsrecon -d example.com -t srv

Performs comprehensive DNS enumeration, including SRV records that might reveal FreeIPA services.

Host

host -t SRV _ldap._tcp.example.com
host -t A ipa.example.com

Simple DNS lookup tool for finding hosts and services.

Output Interpretation

Look for the following in DNS enumeration results:

  • Hostnames containing "ipa", "ldap", or "kerberos"
  • SRV records pointing to FreeIPA services
  • Multiple A records that might indicate FreeIPA replicas
  • PTR records that might reveal internal naming conventions
Web Reconnaissance Tools
Analyzing web interfaces and APIs

WhatWeb

whatweb https://ipa.example.com

Identifies web technologies, including potential FreeIPA version information.

Curl

curl -k https://ipa.example.com/ipa/ui/
curl -k https://ipa.example.com/ipa/config/ca.crt
curl -k https://ipa.example.com/ipa/session/json

Retrieves web content, certificates, and API endpoints from FreeIPA servers.

Nikto

nikto -h https://ipa.example.com -ssl

Performs comprehensive web server scanning to identify vulnerabilities and misconfigurations.

Dirb/Dirbuster

dirb https://ipa.example.com /usr/share/dirb/wordlists/common.txt

Discovers hidden directories and files on the FreeIPA web server.

Output Interpretation

Look for the following in web reconnaissance results:

  • FreeIPA version information in page source or HTTP headers
  • Authentication endpoints and mechanisms
  • API endpoints that might be vulnerable to injection
  • SSL/TLS configuration issues
  • Directory listings that might expose sensitive information

Tool Usage Best Practices

Ethical Considerations

  • Always obtain proper authorization before using these tools
  • Document all activities and maintain detailed logs
  • Avoid causing disruption to production systems
  • Respect data privacy and confidentiality
  • Report all findings to the appropriate stakeholders

Technical Considerations

  • Test tools in a lab environment before using them in production
  • Be aware of the potential impact of each tool
  • Use the least invasive tool that will accomplish the task
  • Monitor system logs during testing to detect any issues
  • Have a rollback plan in case of unexpected issues

Tool Maintenance

  • Keep tools updated to the latest versions
  • Verify tool signatures and hashes before installation
  • Use isolated environments for tool installation and execution
  • Regularly review tool documentation for new features and capabilities
  • Contribute to open-source tool development when possible

Documentation

  • Document all commands and their outputs
  • Capture screenshots of significant findings
  • Maintain a timeline of testing activities
  • Document any deviations from the testing plan
  • Include tool versions and configurations in reports