The ldapsearch quick reference: the flags, a modular copy-paste cheat sheet, and a worked breakdown of every real task. Find the base DN from the Root DSE, bind anonymously or with credentials, list users and groups, enumerate computers, hunt Kerberoastable accounts, page past a size limit, and query over LDAPS.
A practical PowerView guide for authorized AD labs: load the module, enumerate users, groups, ACLs, and trusts from a domain-joined host, read the output, and understand the defenses that watch it.
A practical BloodHound guide: collect Active Directory graph data, ingest it, hunt attack paths to Domain Admin, and read the output without chasing dead ends.