sopa — A practical client for ADWS in Golang

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://github.com/Macmod/sopa
• Blog Title: sopa — A practical client for ADWS in Golang
• Suggested Section: Windows Hardening -> Active Directory Methodology (new page: "ADWS (Active Directory Web Services) Enumeration & Abuse"), cross-linked from Network Services Pentesting -> 389 LDAP and from Kerberos Authentication

🎯 Content Summary

sopa (GitHub: https://github.com/Macmod/sopa)

What it is
sopa is a Golang command-line client that implements the Active Directory Web Services (ADWS) protocol stack: MS-NNS + MC-NMF + SOAP. It exposes common Active Directory operations via web-service s...

🔧 Technical Details

Use ADWS as an alternative control plane to LDAP for AD operations: Implement MS-NNS + MC-NMF + SOAP and use WS-Enumeration (Enumerate + Pull) to run LDAP-style filters with scope/pagination, while using WS-Transfer (Get/Put/Delete/ResourceFactory) to retrieve, modify, delete, or create directory objects. This enables recon and directory changes over ADWS, which may resemble legitimate AD management traffic depending on the environment.

Kerberos targeting correctness when a DC is specified by IP: When Kerberos is enabled and the target is an IP (--dc <ip>), perform a reverse PTR lookup to obtain the DC’s FQDN so the Kerberos SPN/KDC addressing aligns with Kerberos expectations. Ensure SRV/PTR/forward lookups all use a controlled resolver (e.g., the DC’s DNS) via --dns, optionally forcing DNS over TCP with --dns-tcp when UDP is blocked or resp...

🤖 Agent Actions

Updated the existing ADWS page with detailed sopa operational notes (protocol mapping, mex, DNS/DC discovery and Kerberos targeting, auth material options, and custom template creation) and added the repo to references.

Modified

• src/windows-hardening/active-directory-methodology/adws-enumeration.md

Tests not run (not requested).

If you want, I can also add a short note about ADWS port 9389 discovery or integrate a minimal sopa workflow snippet into the “Stealth AD Collection Workflow” section.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://github.com/Macmod/sopa

Content Categories: Based on the analysis, this content was categorized under "Windows Hardening -> Active Directory Methodology (new page: "ADWS (Active Directory Web Services) Enumeration & Abuse"), cross-linked from Network Services Pentesting -> 389 LDAP and from Kerberos Authentication".

Repository Maintenance:

• MD Files Formatting: 954 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0