LDAP Injection Tutorials

Question

I am testing LDAP and trying to check the LDAP Security - LDAP Injection is an attack used to exploit web based applications that construct LDAP statements based on user input - so i want Cheat Sheet for LDAP or methods to inject LDAP to break login page and pass the authentication level.

Answer 1

Although not an injection attack, I like to start this answer with the most common vulnerability related to LDAP based authentication:

Empty passwords

Unlike most other protocols, LDAP allows an anonymous bind with an empty password. Unless anonymous bind has been disabled, a login attempt for any username with an empty password will complete successfully.

The LDAP connection will only have the permission of an anonymous user, but websites usually rely on the result of the login operation.

Connection string injection

Some frameworks connect to the LDAP server with a connection string like this: ldaps://$username:[email protected]

This allows authentication against an LDAP server owned by the attacker: A password-parameter with the value [email protected]?ignored= will result in ldaps://admin:[email protected][email protected]

Filter injection

LDAP filters are used to find the correct entry in the database. For example: (uid=admin). The syntax of filters is in Polish notiation.

For example to check both uid and email for the input string, the filter will say this: |(uid=input)(email=input)

| means "or" and & means "and". Both of them expect exactly two arguments in parentheses. But some LDAP servers ignore additional arguments.

For example a filter expression such as &(uid=input)(status=active) might be exploited by injection to allow access to inactive accounts: &(uid=admin)(1=1)(status=active)`.

Alonso et all go into detail on filter injection.

As far as testing is concerned, you should at least ensure that none of these characters results in an syntax error: ( ) * & | ! = > < ~

Note: Most application use an LDAP search to learn the DN of the person trying to login. Afterwards they attempt an LDAP authentication with the DN returned from the search and the user provided password. Therefore the impact of filter injection tends to be very limited regarding the authentication process itself. But it can be used to disclose other information stored in the LDAP directory.

Answer 2

Here is cheatsheet you may like to see all in one place,most of them:) https://www.owasp.org/index.php/LDAP_Injection_Prevention_Cheat_Sheet