Skip to main content

Documentation Index

Fetch the complete documentation index at: https://mintlify.com/the-useless-one/pywerview/llms.txt

Use this file to discover all available pages before exploring further.

get-netdomaintrust queries Active Directory via LDAP for all trustedDomain objects, revealing the trust relationships a domain maintains with other domains or forests. By default the command returns a focused subset of trust attributes — trustPartner, trustDirection, whenCreated, whenChanged, trustType, trustAttributes, and securityIdentifier — giving you a concise picture of each relationship without noise. Pass --full-data to retrieve every available LDAP attribute on the trust object, which is useful when investigating trust flags, SID filtering settings, or selective authentication configurations during a cross-domain attack path analysis.

Global Flags

-t, --dc-ip
string
required
IP address of the Domain Controller to target.
-w, --workgroup
string
required
Name of the domain used for authentication (e.g. contoso.com).
-u, --user
string
Username to authenticate with against the Domain Controller.
-p, --password
string
Password associated with the specified username.
--hashes
string
NTLM hashes for pass-the-hash authentication. Format: [LMHASH:]NTHASH.
-k
boolean
Use Kerberos authentication. Credentials are read from the KRB5CCNAME ccache file; falls back to command-line credentials if no valid ticket is found.
--tls
boolean
Force a TLS-encrypted connection to the Domain Controller.
--cert
string
Path to the certificate file to use for authentication.
--key
string
Path to the private key file associated with the certificate.
--simple-auth
boolean
Force SIMPLE LDAP authentication instead of the default SASL/NTLM binding.
-l, --logging-level
string
Logging verbosity. Choices: CRITICAL (default), WARNING, DEBUG, ULTRA.
--json
boolean
Print results in JSON format instead of the default tabular output.

Command Flags

-d, --domain
string
Domain to query for trust relationships. Defaults to the domain supplied by -w if omitted.
--full-data
boolean
Return all available LDAP attributes for each trust object instead of the default subset (trustPartner, trustDirection, whenCreated, whenChanged, trustType, trustAttributes, securityIdentifier).

Examples

# List all domain trusts with default attributes
pywerview get-netdomaintrust -t dc.contoso.com -u alice -p 'P@ssw0rd' -w contoso.com

# Full trust details including all LDAP attributes
pywerview get-netdomaintrust -t dc.contoso.com -u alice -p 'P@ssw0rd' -w contoso.com --full-data

# Check trusts of a specific domain reached through the targeted DC
pywerview get-netdomaintrust -t dc.contoso.com -u alice -p 'P@ssw0rd' -w contoso.com -d child.contoso.com

# Pass-the-hash authentication
pywerview get-netdomaintrust -t dc.contoso.com -u alice --hashes aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0 -w contoso.com

# JSON output for pipeline analysis
pywerview get-netdomaintrust -t dc.contoso.com -u alice -p 'P@ssw0rd' -w contoso.com --json

Build docs developers (and LLMs) love