hunting-ldap-injection-and-bind-trust

name	hunting-ldap-injection-and-bind-trust
description	Hunt LDAP injection and bind-trust flaws where untrusted input reaches a directory query or an authentication bind: a request value spliced into a search filter or a distinguished name without escaping, letting the caller alter the filter logic or the search base, and authentication flows that bind with attacker-influenced credentials in ways that permit anonymous or unauthenticated bind to pass as success. Covers filter metacharacter injection, DN injection that changes the subtree searched, and bind logic that treats an empty-password or anonymous bind as a valid login. Use when an application builds LDAP filters or DNs from input, or authenticates by binding to a directory. The untrusted value that becomes filter or DN structure is the source, the search or bind call is the sink, and the missing escape or the accepted anonymous bind is the bug.
license	MIT

Hunting LDAP injection and bind trust: when a filter or a bind decides who you are

LDAP sits under a great deal of enterprise authentication and lookup, and it has two distinct injection-shaped failures. The first is classic filter and distinguished-name injection: when a request value is spliced into a search filter or a DN without escaping the directory's metacharacters, the attacker rewrites the filter's logic (turning a scoped match into a match-anything clause) or redirects the search to a different subtree. The second is a bind-trust failure: LDAP permits anonymous and unauthenticated binds, and a login flow that binds with an empty password, or treats an anonymous bind as success, authenticates an attacker who supplied no valid credential. You find these by tracing untrusted input into filter and DN construction, and by reading the bind logic for the empty-credential and anonymous cases.

When to use

• An application builds LDAP search filters or distinguished names from request input.