A structured lesson workspace with readable content, hands-on examples, and a clean path to completion.
ldapsearch -H ldap://10.129.204.229:389 -x -b "dc=inlanefreight,dc=local" "(objectClass=*)"
That's what enumeration looks like. But the real attack happens when a web application builds LDAP queries from user input without sanitization. You type an asterisk in the username field. The query matches everything. You're in.
(&(objectClass=user)(sAMAccountName=$username)(userPassword=$password)). If you inject * as the username, the query becomes (&(objectClass=user)(sAMAccountName=*)(userPassword=dummy)). The wildcard matches any user. Depending on the application logic, this returns the first user in the directory.Inject * into the password field instead: the query matches any user with any password containing your injected string. Some implementations compare the returned password against user input—but if the application only checks that a result was returned, you bypass authentication entirely.
OpenLDAP on 389. A web application on port 80. The login form likely constructs LDAP queries from the username and password fields. Enter * in both fields. If the application returns a success message or redirects to a dashboard, the injection worked.
| Character | Effect in LDAP |
|---|---|
| * | Matches any number of characters (wildcard) |
| ( | Groups filter expressions |
| ) | Closes filter groups |
| & | Logical AND operator |
| | | Logical OR operator |
| \ | Escape character |
Test each of these in login fields. Error messages revealing LDAP syntax confirm injectability. A response like LDAP: error code 32 - No Such Object means your injection altered the query structure. That's your confirmation.
Mitigation requires input validation (strip LDAP special characters) and parameterized queries. The application must treat user input as data, never as executable filter components. LDAPS (port 636) encrypts traffic but does NOT prevent injection.
LDAP injection is less common than SQL injection in modern applications, but it appears in enterprise software integrating with Active Directory or OpenLDAP. The impact is identical: authentication bypass, data extraction, privilege escalation. One asterisk. That's all it takes when input validation is missing.
Finish the lesson once you have worked through the material. This awards ★ 30 XP.