This document discusses LDAP injection and provides information about LDAP, its advantages and allowed operations. It describes LDAP search and retrieval using filters and nested expressions. The document demonstrates LDAP injection using a null base connection and injected code. It recommends preventing injection by validating input and using encoding methods like ESAPI.

1. LDAP Injection
Sujay Gankidi
28-Nov-2015

2. LDAP
•Open, vendor-neutral, industry standard application protocol for accessing and maintaining distributed
directory information services over an Internet Protocol (IP) network (RFC 4511)
https://en.wikipedia.org/wiki/Lightweight_ Directory Access Protocol
LDAP
•leverage already existing active directory server
•Users don’t have to remember your application password
•enforce single password policy across all applications
•account lockouts
•Faster search and retrieval
Advantages
•TCP and UDP port 389, or port 636 for LDAPS
•Global Catalog is available by default on ports 3268, and 3269 for LDAPS.
Ports of Interest
•StartTLS — use the LDAPv3 Transport Layer Security (TLS) extension for a secure connection
•Bind — authenticate and specify LDAP protocol version
•Search — search for and/or retrieve directory entries
•Compare — test if a named entry contains a given attribute value
•Add a new entry
•Delete an entry
•Modify an entry
•Modify Distinguished Name (DN) — move or rename an entry
•Abandon — abort a previous request
•Extended Operation — generic operation used to define other operations
•Unbind — close the connection (not the inverse of Bind)
Allowed Operations

3. LDAP Search and Retrieval
• LDAP Search filter consists of one or more
Boolean expressions, with logical operators
prefixed to the expression list
• Boolean expression format for LDAP
▫ Attribute Operator Value
▫ Operators {=, ~=, <, <=, >, >= , !}
• Nested Filters
▫ AND (& (E1) (E2) (E3) (E4))
▫ OR (| (E1) (E2) )
▫ Combined (|(& (E1) (E2) )(& (E3) (E4)))

4. LDAP Injection
• DEMO
▫ LDAP Null base connections
▫ LDAP Injection
User Injected code:
(cn=*) – condition is always true .
%00 – Null , Lets stop searching here ;)
Reference: https://pentesterlab.com/exercises/web_for_pentester

5. Prevention
• validate input
• OWASP ESAPI
▫ String encodeForLDAP(String input);
▫ String encodeForDN(String input);

6. Tan-Q