What problem does it solve?
Web applications that build LDAP search filters from unsanitized user input let attackers manipulate filter logic to bypass logins, enumerate directory objects, and extract sensitive attributes like passwords. This Skill provides a structured methodology to identify, confirm, and exploit these injection points during authorized penetration tests.
Core Features & Use Cases
- Authentication Bypass Payloads: A tested matrix of wildcard, negation, NULL-byte, and filter-injection payloads covering OpenLDAP, ADAM/Microsoft LDS, and SunOne server quirks.
- Blind Attribute Extraction: Boolean-oracle techniques and a Python script for per-character brute-forcing of attributes such as userPassword, cn, mail, and uid.
- Confirmation Methods: TRUE/FALSE oracle comparison and error-based detection to avoid false negatives before reporting.
- Use Case: During an authorized test of an intranet portal login backed by Active Directory, submit
user=*&password=* to confirm a wildcard bypass, then use the blind extraction script to recover the admin userPassword one character at a time and document the finding with CVSS scoring and remediation guidance.
Quick Start
Test the target login form for LDAP injection by submitting wildcard payloads like user=* and password=*, then confirm with TRUE/FALSE boolean oracle payloads and extract attributes character by character.
