Injection Attacks: The Complete 2020 Guide

LDAP Injections - Overview

Lightweight Directory Access Protocol

Open and vendor-neutral industry-standard protocol for directory services authentication

Simply put: you can use it to authenticate and authorize access to resources within your organization

Directory Service
(ie: Active Directory)

LDAP

Apps requiring credentials

User account info, passwords

Directory Service
(ie: Active Directory)

LDAP

Apps requiring credentials


(&(objectClass=user)(sAMAccountName=UserName)
(memberof=CN=YourGroup,OU=Users,DC=YourDomain,DC=com))


LDAP Command


https://example.com/searchusers?user=Christophe


https://example.com/searchusers?user=Christophe


searchfilter="(cn="+user+")"


searchfilter="(cn=Christophe)"


https://example.com/searchusers?user=*


searchfilter="(cn=*)"

We can use these kinds of characters to try and cause errors or changes in behavior:

^

#

$

(

|

&

*

Let's say we have a login form:


(&(USER=Username)(PASSWORD=password))


christophe)(&))


(& (USER=christophe)(&))(PASSWORD=whatever-you-want-here))

Sometimes we have to rely on Blind Injection techniques because we're simply not getting any helpful responses.

By using the AND (&) as well as OR (|), we can try to change outputs returned.

Free whitepapers:

By Christophe Limpalair

Co-Founder of Cybr, and Course Author