{"id":492994,"date":"2026-08-31T19:08:29","date_gmt":"2026-08-31T19:08:29","guid":{"rendered":"https:\/\/savepearlharbor.com\/?p=492994"},"modified":"-0001-11-30T00:00:00","modified_gmt":"-0001-11-29T21:00:00","slug":"","status":"publish","type":"post","link":"https:\/\/savepearlharbor.com\/?p=492994","title":{"rendered":"Active Directory security assessment in Rust: from LDAP observations to evidence-backed paths"},"content":{"rendered":"
\n

Finding a misconfiguration and proving an attack path are different tasks. ADhammer is an open-source Rust toolkit built around that distinction.<\/p>\n

The workflow is simple:<\/p>\n

Collect \u2192 Graph \u2192 Validate \u2192 Report<\/p>\n

Collection first<\/p>\n

The collector reads directory objects, ACLs, trusts, delegation, GPO signals, privileged principals, and certificate-template data. The result is an observation of the directory state\u2014not an automatic compromise claim.<\/p>\n

Graph context<\/p>\n

AD relationships become typed edges: membership, control, delegation, enrollment, trust, and privilege. This makes a finding reviewable. A reader can ask which object creates the edge, which control is missing, and whether the route reaches a Tier 0 target.<\/p>\n

Validation with a boundary<\/p>\n

Validation is optional and intended for an authorized lab. When a supported workflow captures the expected proof, the finding records that validation state. Unsupported routes stay marked as potential instead of being promoted to confirmed exploits.<\/p>\n

Evidence in the report<\/p>\n

A useful finding keeps the affected objects, impact, remediation, commands, and proof metadata together. ADhammer exports JSON for automation, Markdown and HTML for human review, and graph-oriented data for existing identity-analysis workflows.<\/p>\n

Why this matters<\/p>\n

A report should let another operator understand what was observed, what was tested, and what remains unconfirmed. That makes remediation easier to prioritize and makes technical criticism productive.<\/p>\n

ADhammer is still early software. It does not claim universal exploitability or replace operator judgment. The project is intended for authorized assessments and research environments, and technical review is welcome.<\/p>\n

Repository: https:\/\/github.com\/icedracon\/adhammer<\/a><\/p>\n<\/div>\n

\u0441\u0441\u044b\u043b\u043a\u0430 \u043d\u0430 \u043e\u0440\u0438\u0433\u0438\u043d\u0430\u043b \u0441\u0442\u0430\u0442\u044c\u0438 https:\/\/habr.com\/ru\/articles\/1076922\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

Finding a misconfiguration and proving an attack path are different tasks. ADhammer is an open-source Rust toolkit built around that distinction.The workflow is simple:Collect \u2192 Graph \u2192 Validate \u2192 ReportCollection firstThe collector reads directory objects, ACLs, trusts, delegation, GPO signals, privileged principals, and certificate-template data. The result is an observation of the directory state\u2014not an automatic compromise claim.Graph contextAD relationships become typed edges: membership, control, delegation, enrollment, trust, and privilege. This makes a finding reviewable. A reader can ask which object creates the edge, which control is missing, and whether the route reaches a Tier 0 target.Validation with a boundaryValidation is optional and intended for an authorized lab. When a supported workflow captures the expected proof, the finding records that validation state. Unsupported routes stay marked as potential instead of being promoted to confirmed exploits.Evidence in the reportA useful finding keeps the affected objects, impact, remediation, commands, and proof metadata together. ADhammer exports JSON for automation, Markdown and HTML for human review, and graph-oriented data for existing identity-analysis workflows.Why this mattersA report should let another operator understand what was observed, what was tested, and what remains unconfirmed. That makes remediation easier to prioritize and makes technical criticism productive.ADhammer is still early software. It does not claim universal exploitability or replace operator judgment. The project is intended for authorized assessments and research environments, and technical review is welcome.Repository: https:\/\/github.com\/icedracon\/adhammer\u0441\u0441\u044b\u043b\u043a\u0430 \u043d\u0430 \u043e\u0440\u0438\u0433\u0438\u043d\u0430\u043b \u0441\u0442\u0430\u0442\u044c\u0438 https:\/\/habr.com\/ru\/articles\/1076922\/<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[],"class_list":["post-492994","post","type-post","status-publish","format-standard","hentry"],"_links":{"self":[{"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=\/wp\/v2\/posts\/492994","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=492994"}],"version-history":[{"count":0,"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=\/wp\/v2\/posts\/492994\/revisions"}],"wp:attachment":[{"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=492994"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=492994"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=492994"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}