LDAP Injection

Notes on LDAP Injection and LDAP Fundamentals

1. Introduction to LDAP Injection

• LDAP (Lightweight Directory Access Protocol) is used for accessing directory servers such as Active Directory (AD).

• Web applications integrate LDAP for authentication and data retrieval.

• LDAP Injection occurs when unsanitized user input is inserted into LDAP queries, leading to authentication bypass, data leakage, and privilege escalation.

---

2. LDAP Foundations

Key LDAP Terminology

• Directory Server (DS): A database-like system storing directory data (e.g., OpenLDAP).

• LDAP Entry: The basic data unit in LDAP containing:

  • Distinguished Name (DN): Unique identifier (e.g., uid=admin,dc=example,dc=com).

  • Attributes: Data fields (e.g., uid, cn, mail).

  • Object Classes: Defines entry types (e.g., Person, Group).

LDAP Operations

• Bind: Authentication with the directory server.

• Unbind: Close the client connection.

• Add: Create a new entry.

• Delete: Remove an entry.

• Modify: Update an entry.

• Search: Query directory entries.

---

3. LDAP Search Filter Syntax

• LDAP queries use search filters enclosed in parentheses ().

• Filters consist of an attribute, an operand, and a value.

Base Operand Filters

Name	Operand	Example	Description
Equality	=	(name=Kaylie)	Matches name=Kaylie
Greater-Than	>=	(uid>=10)	Matches uid ≥ 10
Less-Than	<=	(uid<=10)	Matches uid ≤ 10
Approximate	~=	(name~=Kaylie)	Matches similar values to Kaylie

Logical Combination Filters

Name	Operand	Example	Description
AND	&	(&(name=Kaylie)(title=Manager))	Matches both conditions
OR	`	`	`(
NOT	!	(!(name=Kaylie))	Excludes name=Kaylie

Boolean Filters

Name	Filter
True	(&)
False	`(

Wildcard Filters

Example	Description
(name=*)	Matches all entries with name attribute
(name=K*)	Matches names starting with K
(name=*a*)	Matches names containing a

---

4. Common LDAP Attribute Types

Attribute Type	Description
cn	Full Name
givenName	First Name
sn	Last Name
uid	User ID
objectClass	Object Type
distinguishedName	Unique Identifier
ou	Organizational Unit
title	Job Title
telephoneNumber	Phone Number
mail	Email Address
street	Street Address
postalCode	ZIP Code
member	Group Memberships
userPassword	User Password

---

Key Takeaways

• LDAP is a structured query language for directory services.

• LDAP Injection occurs when attackers manipulate input to change LDAP query behavior.

• Logical operands (&, |, !) allow powerful filtering and are exploitable.

• Input sanitization and proper escaping are crucial for preventing LDAP Injection.