What is LDAP Injection

Definition

LDAP (Lightweight Directory Access Protocol) injection is a security vulnerability that occurs when user-input data is used in LDAP queries without proper validation or sanitization. This can lead to unauthorized access or manipulation of data within an LDAP directory.

List of Vulnerable Points

• Anywhere user input is used for authentication
• Login identifiers, passwords

Vulnerability Verification Method

• Verify if manipulated LDAP queries are inserted and executed in user input values.

USERNAME>(&)

LDAP Injection Cheatsheet

LDAP (Lightweight Directory Access Protocol)

LDAP is a protocol used to implement network directory services, used to store and retrieve directory information such as users, groups, and devices.

What is LDAP(Lightweight Directory Access Protocol)

Network Directory Services

Network directory services are systems designed to centrally manage information such as users, resources, and services in a computer network. The primary purpose is to efficiently perform user identification, authentication, authorization management, resource retrieval, and access.

LDAP, LDAP Server, WAS, DB Structure

Attack Method

Attack Scenario

1. The attacker manipulates malicious LDAP queries and passes them to a vulnerable application.
2. The application uses user input for LDAP queries without proper validation.
3. The manipulated LDAP query is executed, resulting in unauthorized access or data manipulation within the LDAP directory.

Attack Process

Detailed Process Explanation

1. The attacker provides malicious input, passing it to the application.
2. The application executes the vulnerable LDAP query without proper user input validation.
3. The vulnerable LDAP query is sent to and executed by the LDAP server.
4. The LDAP server processes the query and returns the result to the application.
5. The application displays the result to the user or utilizes it for other purposes.

Mitigation Strategies

• Use prepared statements.
• Implement whitelist-based filtering to allow only alphanumeric characters (a-z, A-Z, 0-9).
• Minimize access permissions to the LDAP server, restricting application accounts to the least necessary privileges.
• Apply rulesets to web firewalls to filter LDAP-related special characters.
• Target filtering:

LDAP Injection Cheatsheet

Basic LDAP Search Query

LDAP (Lightweight Directory Access Protocol) is commonly used to retrieve specific information from directory services (e.g., Active Directory). The following is an example of an LDAP query for basic searches:

(&(attribute1=value1)(attribute2=value2))

Let's break down the components of the query:

• The & symbol is the logical "AND" operator that combines multiple conditions.
• attribute1 and attribute2 are the names of the attributes you want to search within the directory (e.g., "cn" for common name, "mail" for email).
• value1 and value2 are the values you're looking for within those attributes.

You can customize attributes and values to match specific requirements. For example, to search for a user with the common name "John Doe" and the email address "john.doe@example.com," the query would be:

(&(cn=John Doe)(mail=john.doe@example.com))

Thus, for logging in, you can use the following query:

(&(cn=USERNAME)(userPassword=PASSWORD))

Basic LDAP Injection Query

(&) in an LDAP filter doesn't only mean the "AND" operator; it's also a syntactic element that represents an empty filter. You can use this to inject USERNAME>(&) into the identifier field. This will lead to the execution of the query as follows:

(&(cn=USERNAME>(&))(userPassword=PASSWORD))

Depending on the (&), the latter filter becomes unconstrained, and all entries are returned. This naturally results in a successful login.

What is LDAP(Lightweight Directory Access Protocol)

Definition

LDAP (Lightweight Directory Access Protocol) is a protocol that provides directory services as part of the internet protocol stack.

LDAP Structure

LDAP inherently follows a tree structure and stores data with specific conditions. Each node is referred to as an entry, and classified information is stored in each entry.

Entry Name Table

Web Application Structure Using LDAP

Purpose

LDAP provides a way to store and retrieve information about users, groups, devices, and more using a hierarchical data structure.

Advantages

• Efficient data retrieval is possible due to the hierarchical structure of directory services.
• Offers features for authentication and access control, enhancing security.
• Widely known standard protocol with support for various platforms and languages.

Disadvantages

• LDAP can require complex setup and management.
• It might not be suitable for handling large amounts of data.
• It's more specialized for retrieval and storage rather than insertion or modification.

Example

import ldap

# Connect to LDAP server
conn = ldap.initialize('ldap://ldap.example.com')

# Binding (Authentication)
conn.simple_bind_s('username', 'password')

# Search
base_dn = 'ou=users,dc=example,dc=com'
filter = '(& (cn=john))'
attributes = ['cn', 'email']
result = conn.search_s(base_dn, ldap.SCOPE_SUBTREE, filter, attributes)

# Print results
for dn, entry in result:
    cn = entry['cn'][0].decode('utf-8')
    email = entry['email'][0].decode('utf-8')
    print(f'CN: {cn}, Email: {email}')

# Unbind (Disconnect)
conn.unbind()

In the Python code, the ldap module is used to connect to the LDAP server, perform binding (authentication), search, handle results, and disconnect. The ldap.initialize function establishes a connection to the LDAP server, conn.simple_bind_s performs authentication, and conn.search_s is used for searching. The results are then processed and printed.