How b-3llum/kerb-map works
kerb-map is an authenticated Active Directory Kerberos attack-surface mapper. The operator starts a scan through the CLI, which establishes LDAP access and runs enumeration, posture audits, and vulnerability checks; findings are consolidated into prioritized targets and exported as reports or graph data. The README also documents no-credential scans, optional aggressive RPC probes, scan caching, diffing, and resume support. Some subsystem links reflect documented capabilities because their implementation was not sampled.
Main entry points: cli.py CLI workflow · ldap_client.py LDAP client · cves CVE probes · modules Legacy audits
Components 19
Scan orchestration
- CLI workflow
kerb_map/cli.py - LDAP client
kerb_map/auth/ldap_client.py
Attack surface checks
- Legacy audits
kerb_map/modules - Plugin audits
kerb_map/modules - Hygiene audit
kerb_map/modules/hygiene_auditor.py - AD CS checks
kerb_map/modules/adcs_extended.py - CVE probes
kerb_map/modules/cves - No-credential scans
kerb_map/modules
Finding analysis
- Scan findings
- Priority scoring
kerb_map/modules/scorer.py
Scan state
- SQLite scan cache
kerb_map/db/cache.py - Resume state
kerb_map/resume.py - Scan comparison
kerb_map/diff.py
Results and exports
- Report exporters
kerb_map/output/exporter.py - BloodHound CE
kerb_map/output/bloodhound_ce.py
Other components
- Operator
- Active Directory
- DC RPC services
- Reports and files
Connections 26
- Operator → CLI workflow: configures scan
- CLI workflow → LDAP client: authenticates
- LDAP client → Active Directory: queries LDAP
- CLI workflow → Legacy audits: runs checks
- CLI workflow → Plugin audits: dispatches plugins
- CLI workflow → Hygiene audit: runs audit
- CLI workflow → AD CS checks: runs checks
- CLI workflow → CVE probes: runs probes
- CLI workflow → No-credential scans: runs scans
- Legacy audits → LDAP client: queries directory
- Plugin audits → LDAP client: queries directory
- Hygiene audit → LDAP client: queries directory
- AD CS checks → LDAP client: queries directory
- CVE probes → LDAP client: queries directory
- CVE probes → DC RPC services: probes when enabled
- No-credential scans → Active Directory: enumerates domain
- CLI workflow → Priority scoring: prioritizes findings
- Priority scoring → Scan findings: returns priorities
- CLI workflow → SQLite scan cache: stores scan
- CLI workflow → Resume state: loads progress
- CLI workflow → Scan comparison: compares scans
- SQLite scan cache → Scan comparison: supplies cached scans
- CLI workflow → Report exporters: exports results
- CLI workflow → BloodHound CE: exports graph data
- Report exporters → Reports and files: writes reports
- BloodHound CE → Reports and files: writes archive