skills.rest
bpnrockstar
bpnrockstarCOMMUNITY
Explore all skills by this author →
GitHub

hunt-ldap

Detect and exploit LDAP and XPath injection vulnerabilities in authentication mechanisms.

Updated Jul 1, 2026
Search Tags:#authentication#vulnerability#injection#xpath#ldap
One-click install
npx skills add https://github.com/bpnrockstar/UnifiedBugHunter --skill hunt-ldap-bpnrockstar
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-ldap
Source: https://github.com/bpnrockstar/UnifiedBugHunter/tree/main/skills/hunt-ldap
Command: npx skills add https://github.com/bpnrockstar/UnifiedBugHunter --skill hunt-ldap-bpnrockstar

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

This Skill is designed to identify and exploit vulnerabilities in LDAP and XPath injection, specifically targeting authentication bypass, blind attribute exfiltration, and enumeration.

Core Features & Use Cases

  • Authentication Bypass: Identify and exploit scenarios where authentication can be bypassed using LDAP injection techniques.
  • Blind Attribute Exfiltration: Exfiltrate attributes and credentials from LDAP servers without prior knowledge of the content.
  • AD Enumeration: Enumerate Active Directory attributes such as usernames and groups.
  • XPath Injection: Exploit XPath injection vulnerabilities in XML-backed authentication systems.
  • Use Case: When auditing systems for security vulnerabilities, this Skill can be used to test and report on LDAP and XPath injection vulnerabilities.

Quick Start

Use the 'hunt-ldap' skill to check for LDAP injection vulnerabilities on the target system.

Frequently Asked Questions about hunt-ldap

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect and exploit LDAP injection vulnerabilities in authentication mechanisms?▼

You can detect LDAP injection vulnerabilities by testing authentication mechanisms with crafted inputs designed to bypass filters, exfiltrate blind attributes, and enumerate directory objects within RFC 4515 constraints.

What is XPath injection and how does it affect XML-backed authentication systems?▼

XPath injection targets XML-backed authentication systems by manipulating input fields to alter XPath queries, enabling unauthorized authentication bypass and unauthorized data access within XML data structures.

Can I enumerate Active Directory attributes like usernames and groups using LDAP injection?▼

Yes, Active Directory attributes including usernames and groups can be enumerated using LDAP injection techniques that extract blind attributes from directory servers without prior knowledge of stored content.

Do I need prior knowledge of LDAP and Active Directory structures to test for injection vulnerabilities?▼

Yes, knowledge of LDAP and Active Directory structures alongside XPath injection techniques is required, as the process operates within RFC 4515 LDAP filter grammar constraints to identify authentication and access control flaws.

How does blind attribute exfiltration work against LDAP servers?▼

Blind attribute exfiltration extracts attributes and credentials from LDAP servers by injecting conditional queries that infer content through boolean responses, enabling data retrieval without prior knowledge of stored directory content.

Related Skills

zangjeicyzangjeicy

pinggy-tunnel

Expose local network services via SSH-based reverse tunneling.

Community
Intermediate
AcczdyAcczdy
2

performing-privileged-account-discovery

Enumerate privileged groups and service accounts via LDAP queries into JSON reports.

Community
Intermediate
giosuetedeschi-specgiosuetedeschi-spec

Burp Suite Web Application Testing

Intercept and modify HTTP traffic to test web application security.

Community
Advanced
AndyAnh174AndyAnh174

Cross-Site Scripting and HTML Injection Testing

Detect and exploit stored, reflected, and DOM-based XSS vulnerabilities.

Community
Advanced