What is LDAP Injection?

LDAP injection is a type of injection attack that targets the Lightweight Directory Access Protocol (LDAP), which is used to access and manage directory information. The goal of an LDAP injection attack is to exploit vulnerabilities in applications that use LDAP to authenticate users or access directory information.

An LDAP injection attack involves the injection of malicious LDAP code into an application, with the intent of tricking the application into executing unauthorized commands or accessing sensitive information. This can allow an attacker to gain unauthorized access to an application, compromise the integrity of directory data, or launch further attacks on other systems or applications.

Example of LDAP Injection

Suppose there is a web application that allows users to authenticate using LDAP credentials. The application prompts the user to enter their LDAP username and password in a login form, and the form then submits the user’s credentials to the LDAP server for authentication.

An attacker could potentially exploit this authentication process by submitting malicious input to the application’s LDAP query parameters, such as the username field. For example, the attacker could enter the following input into the username field:

*)(uid=*))(|(uid=*))

This input is designed to exploit a vulnerability in the application’s LDAP query by injecting additional code into the query. Specifically, the input is designed to cause the application to retrieve all LDAP records, regardless of the user’s entered credentials.

The LDAP query that the application constructs from this input might look something like this:

(&(objectClass=person)(uid=*)(uid=*))(|(uid=*))

This query retrieves all records from the LDAP directory that match the criteria specified by the input, effectively bypassing the authentication check and granting the attacker unauthorized access to the application.

The application’s response to this attack might vary, depending on how the application is configured and how it handles LDAP queries. In some cases, the application may return an error message indicating that the authentication failed. In other cases, the application may simply log the user in without checking their credentials, giving the attacker full access to the application’s resources.

Tools and Method For LDAP Injection

Tools:

• Burp Suite: This is a popular web application testing tool that can be used to test for LDAP injection vulnerabilities. It has a variety of features for intercepting and modifying HTTP requests and responses, which can be useful for identifying and exploiting LDAP injection vulnerabilities.
• ldapsearch: This is a command-line tool that can be used to query LDAP servers and test for LDAP injection vulnerabilities. It can be used to construct and execute custom LDAP queries, which can be helpful for identifying injection points and testing for vulnerabilities.

Methods:

• Manual testing: This involves manually crafting input strings and submitting them to the application to see how it handles them. This can be time-consuming, but it can also be effective for identifying injection points and vulnerabilities that might be missed by automated tools.
• Fuzzing: This involves using automated tools to generate a large number of input strings and submitting them to the application to see how it handles them. Fuzzing can be an effective way to identify injection points and vulnerabilities, but it can also generate a lot of noise and false positives.

Payloads Of LDAP Injection

Basic payloads:

• Single quote character: ‘
• Double quote character: “
• Semi-colon character: ;

LDAP-specific payloads:

• Wildcard character: *
• Pipe character: |
• Parenthesis characters: ( and )
• Null byte: \00

Custom payloads:

• Search filters: (&(objectClass=)(uid=)(userPassword=*))
• LDAP injection payloads with SQL injection payloads combined: ‘ or ‘1’=’1′– or ‘|(uid=))(|(uid=*’

It’s important to note that these payloads are just examples and may not work in all situations. The specific payloads that are effective will depend on the application being tested and its implementation of LDAP queries. It’s also important to use these payloads responsibly and only on systems that you have permission to test.

Follow us on Twitter: Hacktube5

Follow us on Youtube: Hacktube5