-
Notifications
You must be signed in to change notification settings - Fork 220
Open
Description
Running SharpHound 2.7.2 with -c all or -c dconly only results in 2000-2500 users being enumerated in our environment when there are actually more than 120,000 users that were reliably enumerated with earlier versions.
Earlier version of Sharphound returning a complete set of users:
% jsonpp 20250715194931_users.json | tail
}
],
"meta": {
"methods": 6583295,
"type": "users",
"count": 146090,
"version": 6,
"collectorversion": "2.6.7.0"
}
}%
Current version:
% jsonpp 20250924134957_users.json | tail
}
],
"meta": {
"methods": 15725567,
"type": "users",
"count": 2516,
"version": 6,
"collectorversion": "2.7.2.0"
}
}
The number of users returned varies significantly from 2000 or 2500 up to 80,000 and 120,000 on some attempts. It seems possible this was introduced by new timeout code.
0xd6cb6d73
Metadata
Metadata
Assignees
Labels
No labels