Skip to main content

Documentation Index

Fetch the complete documentation index at: https://mintlify.com/the-useless-one/pywerview/llms.txt

Use this file to discover all available pages before exploring further.

get-netdomain connects to the target Domain Controller over the \samr RPC pipe and enumerates the domain names registered in its SAM database. This gives you a fast, lightweight view of the domain names visible from the targeted DC — useful as an orientation step at the start of an engagement before diving into deeper LDAP enumeration. Because this command uses an RPC call rather than LDAP, it does not support certificate or simple-auth options; authenticate with a username/password, NTLM hash, or Kerberos ticket instead.

​
Global Flags

​
-t, --dc-ip
string
required
IP address of the Domain Controller to target.
​
-w, --workgroup
string
required
Name of the domain used for authentication (e.g. contoso.com).
​
-u, --user
string
Username to authenticate with against the Domain Controller.
​
-p, --password
string
Password associated with the specified username.
​
--hashes
string
NTLM hashes for pass-the-hash authentication. Format: [LMHASH:]NTHASH.
​
-k
boolean
Use Kerberos authentication. Credentials are read from the KRB5CCNAME ccache file; falls back to command-line credentials if no valid ticket is found.
​
--tls
boolean
Force a TLS-encrypted connection to the Domain Controller.
​
-l, --logging-level
string
Logging verbosity. Choices: CRITICAL (default), WARNING, DEBUG, ULTRA.
​
--json
boolean
Print results in JSON format instead of the default tabular output.

​
Examples

# Get domain information from the targeted DC
pywerview get-netdomain -t dc.contoso.com -u alice -p 'P@ssw0rd' -w contoso.com

# Authenticate with NTLM hash (pass-the-hash)
pywerview get-netdomain -t dc.contoso.com -u alice --hashes aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0 -w contoso.com

# Use Kerberos ticket from ccache
pywerview get-netdomain -t dc.contoso.com -k -w contoso.com

# JSON output
pywerview get-netdomain -t dc.contoso.com -u alice -p 'P@ssw0rd' -w contoso.com --json

Build docs developers (and LLMs) love

Get started for freeTalk to us