hunt-ldap

Capture a baseline response with valid-format credentials first, then send a single unbalanced parenthesis in the username. A filter-syntax error or 500 on the unbalanced input but not on balanced input indicates the input reaches an LDAP filter unescaped.

Close the current filter group and append an always-true OR condition, such as *)(uid=*))(|(uid=*, keeping total parentheses balanced. Validate the bypass returns a real authenticated session and that a logically false control payload still fails.

No. Active Directory stores passwords in unicodePwd, which is write-only and never returned by searches. Hash exfiltration via userPassword only works on non-AD directories like OpenLDAP or 389-DS where ACLs expose that attribute.

Raw response-size diffing is distorted by WAF banners, CSRF tokens, and length jitter from the injected character itself. Use paired true/false control filters, repeat each positive character three times, and re-verify the false control between rounds.

Search-filter injection places input inside an (attr=value) filter where * ( ) & | ! are significant. DN injection places input inside a Distinguished Name where , = + " and / matter and * is not a wildcard, so payloads do not transfer between the two.

XPath has no comment syntax, so payloads like ' or '1'='1 must keep quotes and brackets balanced rather than truncating the query. It targets XML-backed authentication stores using predicates like //users/user[name/text()='x'].