LDAP (Lightweight Directory Access Protocol)
Directory map
Summary
LDAP is a protocol for accessing and managing hierarchical directory services over TCP/IP (port 389) or SSL/TLS (port 636). It is widely used for centralized authentication and directory management, most notably as the underlying protocol for Microsoft Active Directory.
From an offensive perspective, LDAP services are interesting for two reasons. First, an exposed LDAP port (389) can often be queried anonymously (ldapsearch -x) to enumerate users, groups, and organizational structure. Second, web applications that delegate authentication to LDAP without sanitising input are vulnerable to LDAP injection — injecting the wildcard * into username and password fields can cause the underlying LDAP query to match any entry, bypassing authentication entirely. This is the LDAP equivalent of a SQL injection auth bypass.