LDAP

Overview

LDAP (Lightweight Directory Access Protocol) is a protocol used to access and manage directory information. A directory is a hierarchical data store containing information about network resources such as users, groups, computers, printers, and other devices. LDAP runs over TCP/IP (port 389) or SSL/TLS (port 636, LDAPS) and is platform-independent.

Functionality

Strengths

Weaknesses

Common Use Cases

LDAP vs Active Directory

LDAP and Active Directory are related but serve different purposes. LDAP is a protocol that specifies how to access and modify directory services. Active Directory is a directory service that uses LDAP as one of its protocols.

How LDAP Works

LDAP uses a client-server architecture. Clients send LDAP messages encoded in ASN.1 (Abstract Syntax Notation One) over TCP/IP. Servers process requests and return responses in the same format.

Request Components

Response Components

ldapsearch

ldapsearch is a command-line utility for querying LDAP directory services.

Syntax

ldapsearch -H ldap://<server>:<port> -D "<bind_dn>" -w <password> -b "<base_dn>" "<filter>"

Example

ldapsearch -H ldap://ldap.example.com:389 \
  -D "cn=admin,dc=example,dc=com" \
  -w secret123 \
  -b "ou=people,dc=example,dc=com" \
  "(mail=john.doe@example.com)"

This command:

1. Connects to ldap.example.com on port 389
2. Authenticates as cn=admin,dc=example,dc=com with password secret123
3. Searches under the base DN ou=people,dc=example,dc=com
4. Returns entries matching (mail=john.doe@example.com)

Example response:

dn: uid=jdoe,ou=people,dc=example,dc=com
objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
objectClass: top
cn: John Doe
sn: Doe
uid: jdoe
mail: john.doe@example.com

result: 0 Success

Anonymous bind (unauthenticated enumeration)

ldapsearch -H ldap://<target>:389 -x -b "dc=example,dc=com"

LDAP Injection

Overview

LDAP injection is an attack that exploits web applications using LDAP for authentication or user information storage. Malicious characters injected into LDAP queries can alter query behaviour, bypass authentication, and expose directory data.

It is analogous to SQL injection but targets directory services rather than databases.

Special Characters

Vulnerable Query Example

An application using the following LDAP query for authentication:

(&(objectClass=user)(sAMAccountName=$username)(userPassword=$password))

Bypass via username wildcard

Injecting * as the username makes the query match any user account:

$username = "*"
$password = "dummy"

Resulting query:

(&(objectClass=user)(sAMAccountName=*)(userPassword=dummy))

This matches any account whose password is dummy — or in misconfigured servers, any account at all.

Bypass via password wildcard

Injecting * as the password matches any password:

$username = "dummy"
$password = "*"

Resulting query:

(&(objectClass=user)(sAMAccountName=dummy)(userPassword=*))

This matches the dummy account with any password.

Consequences

• Unauthorised access to sensitive data
• Privilege escalation
• Full control over the application or server
• Data integrity risks (attackers may alter or delete directory entries)

Mitigations

• Validate and sanitise all user input before incorporating it into LDAP queries
• Remove or escape LDAP special characters (*, (, ), \, NUL) from input
• Use parameterised queries so user input is treated as data, not executable code
• Enforce least-privilege bind accounts

Enumeration

Nmap

nmap -p- -sC -sV --open --min-rate=1000 <target>

Example output:

PORT    STATE SERVICE VERSION
80/tcp  open  http    Apache httpd 2.4.41 ((Ubuntu))
389/tcp open  ldap    OpenLDAP 2.2.X - 2.3.X

Port 389 (LDAP) open alongside a web application on port 80 is a strong indicator that the web app uses LDAP for authentication — a candidate for LDAP injection testing.

Exploitation — Authentication Bypass

When a web application uses LDAP for authentication and does not sanitise input, injecting the wildcard * into both the username and password fields can bypass the authentication check entirely.

Payload:

Username: *
Password: *

This causes the application’s LDAP query to match any user with any password, granting access without valid credentials.

This is the LDAP equivalent of the classic SQL injection ' OR '1'='1 authentication bypass.