> For the complete documentation index, see [llms.txt](https://ttp.parzival.sh/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ttp.parzival.sh/pentesting/infrastructure/networks/subnet-enumeration.md).

# Subnet Enumeration

CrackMapExec enables us to extract subnet information from Active Directory assuming that we have the following:

* Valid credentials for the domain
* Can query LDAP

We can then use CrackMapExec's `subnets` module against the domain controller to return a list of subnets:

```bash
crackmapexec ldap $ip -d $domain -u $username -p $password -M subnets
```

### References

{% embed url="<https://podalirius.net/en/articles/active-directory-sites-and-subnets-enumeration/>" %}