hunt-ldap

Name: hunt-ldap
Availability: InStock
Author: entrovyx

Detect and exploit LDAP and XPath injection vulnerabilities in authentication interfaces.

3|1|Updated Jul 2, 2026

Search Tags:#security #injection #pentesting #enumeration #xpath #ldap

Ready to run

npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill hunt-ldap-entrovyx

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: hunt-ldap
Source: https://github.com/EntroVyx/hermes-agent-offsec/tree/main/skills/offsec/redteam/hunt-ldap
Command: npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill hunt-ldap-entrovyx

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill addresses the difficulty of identifying and exploiting LDAP and XPath injection vulnerabilities, which are often overlooked due to their complex filter-based syntax and the lack of public, verbatim payload documentation.

Core Features & Use Cases

Injection Detection: Provides a systematic methodology to identify unescaped LDAP filter inputs and XPath vulnerabilities through baseline comparison and syntax-error analysis.
Advanced Exploitation: Enables blind attribute exfiltration, authentication bypass, and Active Directory enumeration using boolean oracles and parenthesis-balancing techniques.
Use Case: Use this skill when auditing corporate SSO portals, directory-backed search APIs, or XML-based authentication systems to identify critical bypasses or sensitive data leaks.

Quick Start

Use the hunt-ldap skill to perform a baseline analysis and test for LDAP injection vulnerabilities on the target login endpoint.

Frequently Asked Questions about hunt-ldap

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I test for LDAP injection vulnerabilities in corporate SSO portals?▼

To identify LDAP injection vulnerabilities, compare application baselines against injected LDAP filter syntax inputs. This detects unescaped directory search inputs by analyzing systematic syntax errors and behavioral differences in the target interface.

How does blind attribute exfiltration work in XPath injection exploitation?▼

Blind attribute exfiltration in XPath injection works by constructing boolean oracles to systematically extract sensitive data from XML-backed data stores. It confirms vulnerabilities by evaluating true or false conditions based on the application's response.

Can I use LDAP injection techniques for Active Directory enumeration?▼

Yes, you can use LDAP injection techniques for Active Directory enumeration. By manipulating directory service filters and leveraging authentication bypass methods, you can extract sensitive directory attributes from corporate directory-backed search APIs.

What is the best way to hunt for XPath injection in XML-backed data stores?▼

The best way to hunt for XPath injection in XML-backed data stores is through baseline comparison and syntax-error analysis. This methodology identifies unescaped inputs and enables boolean oracle construction for blind data extraction.

Does LDAP injection hunting work on web application security assessments for directory services?▼

Yes, LDAP injection hunting works effectively on web application security assessments for directory services. It targets corporate SSO, directory search interfaces, and authentication systems to identify critical bypasses and sensitive data leaks.

Why does LDAP filter syntax manipulation require parenthesis-balancing techniques?▼

LDAP filter syntax manipulation requires parenthesis-balancing techniques to construct valid boolean oracles. Properly balancing parentheses ensures the injected filters execute correctly, allowing you to confirm vulnerabilities and exfiltrate sensitive directory attributes.