{
  "port": 389,
  "protocol": "tcp",
  "service": "LDAP",
  "oneLiner": "LDAP directory service, cleartext or STARTTLS, TCP 389.",
  "whatItIs": "Directory servers — OpenLDAP slapd, Active Directory domain controllers, 389 Directory Server — listen on TCP 389 for bind, search, and modify operations. OpenLDAP's default listener URL is ldap:/// which means LDAP over TCP on all interfaces on port 389. On a scan it usually marks a domain controller or an identity store that applications authenticate against. Port 636 is the separate implicit-TLS listener (ldaps://); 389 itself is cleartext unless the client negotiates STARTTLS.",
  "exposure": {
    "verdict": "never",
    "note": "A simple bind on 389 without STARTTLS sends the username and password in cleartext, and anonymous binds often leak the whole directory tree."
  },
  "checkCommand": "ldapsearch -x -H ldap://DC_HOST:389 -s base -b \"\" namingContexts",
  "links": [
    {
      "title": "RFC 4511 — LDAP: The Protocol",
      "url": "https://datatracker.ietf.org/doc/html/rfc4511",
      "kind": "spec"
    },
    {
      "title": "OpenLDAP 2.6 Administrator's Guide — Running slapd",
      "url": "https://www.openldap.org/doc/admin26/runningslapd.html",
      "kind": "official-docs"
    },
    {
      "title": "OpenLDAP (GitHub mirror)",
      "url": "https://github.com/openldap/openldap",
      "kind": "github"
    },
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml",
      "kind": "iana"
    }
  ]
}