📖 What is LDAP Injection?
LDAP Injection is a vulnerability that occurs when an application fails to properly sanitize user input used in a Lightweight Directory Access Protocol (LDAP) query. Attackers can manipulate the query to bypass authentication or extract sensitive information from the directory service.
"Similar to SQLi, the key here is the lack of input validation; always look for ways to break the query logic using wildcards like (*)."
📚 Certification: CompTIA PenTest+ (PT0-002)
🔑 What are the Key Concepts of LDAP Injection?
- ▸ Lack of input sanitization allows attackers to insert special characters like parentheses and ampersands to alter the intended logic of an LDAP query.
- ▸ Authentication bypass often occurs when a wildcard (*) is used in a login field, causing the directory to return a successful match regardless of the password.
- ▸ Information disclosure is achieved by manipulating filters to extract sensitive directory data, such as user lists, email addresses, or organizational structure.
- ▸ LDAP uses prefix notation for filters; injection attacks target these logical operators to change the query's scope or bypass specific attribute requirements.
- ▸ The primary remediation is the use of parameterized queries or strict input validation libraries that escape characters specific to the LDAP protocol.
🎯 How does LDAP Injection appear on the PT0-002 Exam?
You may be asked to identify a vulnerability after observing that entering a wildcard character in a corporate directory search field returns all user accounts.
A scenario might describe a login page where an attacker enters a payload like *)(uid=*))(|(uid=* to bypass authentication; you must recognize this as LDAP injection.
Expect questions where you must differentiate between SQL injection and LDAP injection based on the target system, such as an Active Directory or OpenLDAP server.
❓ Frequently Asked Questions
How does LDAP injection differ from SQL injection in a practical sense?
While both exploit poor input validation, SQLi targets relational databases using SQL syntax. LDAP injection targets directory services using LDAP filter syntax, typically focusing on object attributes and hierarchical structures.
Why is the asterisk (*) so critical in LDAP injection attacks?
The asterisk serves as a wildcard in LDAP filters. If an application doesn't escape it, an attacker can use it to match any value, often bypassing authentication or dumping entire directories.