LDAP injection - Revision history

Jmanico at 16:25, 9 December 2016

2016-12-09T16:25:07Z

2015-04-15T16:52:11Z

‎Risk Factors

2009-04-07T20:18:36Z

2009-02-16T12:52:37Z

‎Example 1

2009-02-16T12:52:24Z

‎Example 1

2009-02-16T12:51:33Z

2008-09-14T01:28:57Z

2008-09-12T12:52:19Z

2008-09-12T12:51:47Z

‎Example 2

2008-09-12T12:50:29Z

‎Example 1

@@ Line 2: / Line 2: @@
 Last revision: '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''
 ==Description==
 LDAP Injection is an attack used to exploit web based applications that construct LDAP statements based on user input. When an application fails to properly sanitize user input, it’s possible to modify LDAP statements using a local proxy. This could result in the execution of arbitrary commands such as granting permissions to unauthorized queries, and content modification inside the LDAP tree.
 The same advanced exploitation techniques available in [[SQL Injection]] can be similarly applied in LDAP Injection.
 ==References==
-* http://www.blackhat.com/presentations/bh-europe-08/Alonso-Parada/Whitepaper/bh-eu-08-alonso-parada-WP.pdf
+* https://www.owasp.org/index.php/LDAP_Injection_Prevention_Cheat_Sheet
 __NOTOC__

@@ Line 10: / Line 10: @@
 LDAP Injection is an attack used to exploit web based applications that construct LDAP statements based on user input. When an application fails to properly sanitize user input, it’s possible to modify LDAP statements using a local proxy. This could result in the execution of arbitrary commands such as granting permissions to unauthorized queries, and content modification inside the LDAP tree.
 The same advanced exploitation techniques available in [[SQL Injection]] can be similarly applied in LDAP Injection.
 ==Examples==

@@ Line 29: / Line 29: @@
 If the variable $userName is not validated, it could be possible accomplish LDAP injection, as follows:
 *If a user puts “*” on box search, the system may return all the usernames on the LDAP base
-*If a user puts “jonys) (| (password = * ) )”, it will generate the code bellow revealing jonys’ password
+*If a user puts “jonys) (| (password = * ) )”, it will generate the code bellow revealing jonys’ password ( cn = jonys ) ( | (password = * ) )
 ===Example 2===

@@ Line 28: / Line 28: @@
 If the variable $userName is not validated, it could be possible accomplish LDAP injection, as follows:
- *If a user puts “*” on box search, the system may return all the usernames on the LDAP base
+*If a user puts “*” on box search, the system may return all the usernames on the LDAP base
- *If a user puts “jonys) (| (password = * ) )”, it will generate the code bellow revealing jonys’ password
+*If a user puts “jonys) (| (password = * ) )”, it will generate the code bellow revealing jonys’ password
   ( cn = jonys ) ( | (password = * ) )

@@ Line 5: / Line 5: @@
 <br>
 [[Category:OWASP ASDR Project]]
-[[ASDR Table of Contents]]__TOC__
+[[ASDR Table of Contents]]
 ==Description==
 LDAP Injection is an attack used to exploit web based applications that construct LDAP statements based on user input. When an application fails to properly sanitize user input, it’s possible to modify LDAP statements using a local proxy. This could result in the execution of arbitrary commands such as granting permissions to unauthorized queries, and content modification inside the LDAP tree.
 The same advanced exploitation techniques available in [[SQL Injection]] can be similarly applied in LDAP Injection.
@@ Line 15: / Line 14: @@
 ==Risk Factors==
 TBD

@@ Line 91: / Line 91: @@
 ==Related [[Threat Agents]]==
 * [[internal software developer]]
 ==Related [[Attacks]]==
 * [[Interpreter Injection]]
-*[[Interpreter Injection]]
+* [[SQL Injection]]
-*[[SQL Injection]]
+* [[Command Injection]]
-*[[Command Injection]]
+* [[Relative Path Traversal]]
-*[[Relative Path Traversal]]
+* [[Resource Injection]]
-*[[Resource Injection]]
+* [[Path Manipulation]]
 ==Related [[Vulnerabilities]]==
+* [[:Category:Input Validation Vulnerability]]
 ==Related [[Controls]]==
 * [[:Category:Input Validation]]
 ==References==
 * http://www.blackhat.com/presentations/bh-europe-08/Alonso-Parada/Whitepaper/bh-eu-08-alonso-parada-WP.pdf
 * http://www.ietf.org/rfc/rfc1960.txt A String Representation of LDAP Search Filters (RFC1960)
 * http://www.redbooks.ibm.com/redbooks/SG244986.html IBM RedBooks - Understanding LDAP
 * http://www.webappsec.org/projects/threat/classes/ldap_injection.shtml
 [[Category:Injection]]
 [[Category:Attack]]
 __NOTOC__

@@ Line 35: / Line 35: @@
 ===Example 2===
-The following vulnerable code is used in an ASP web application which provides login with LDAP data base.
+The following vulnerable code is used in an ASP web application which provides login with an LDAP database.
-On line 11, the variable userName is initialized and validated to check if it’s not in blank. Then, the content of this variable is used to construct a LDAP query used by SearchFilter on line 28. The attacker has the chance specify what will be queried on LDAP server, and see the result on the line 33 to 41, are all results and their attributes are displayed.
+On line 11, the variable userName is initialized and validated to check if it’s not blank. Then, the content of this variable is used to construct an LDAP query used by SearchFilter on line 28. The attacker has the chance specify what will be queried on LDAP server, and see the result on the line 33 to 41; all results and their attributes are displayed.
 Commented vulnerable asp code: