Testing for LDAP Injection (OTG-INPVAL-006) - Revision history

Tony Hsu HsiangChih: /* References */

2017-02-08T03:31:47Z

‎References

Jmanico: cleanup and addition of defense cheatsheet

2016-12-12T18:18:11Z

cleanup and addition of defense cheatsheet

Andrew Muller: Andrew Muller moved page Testing for LDAP Injection (OTG-INPVAL-007) to Testing for LDAP Injection (OTG-INPVAL-006)

2014-08-08T12:03:31Z

Andrew Muller moved page Testing for LDAP Injection (OTG-INPVAL-007) to Testing for LDAP Injection (OTG-INPVAL-006)

Andrew Muller at 16:06, 31 July 2014

2014-07-31T16:06:34Z

Andrew Muller: Andrew Muller moved page Testing for LDAP Injection (OWASP-DV-006) to Testing for LDAP Injection (OTG-INPVAL-007): Align with Common Numbering

2014-07-31T14:33:41Z

Andrew Muller moved page Testing for LDAP Injection (OWASP-DV-006) to Testing for LDAP Injection (OTG-INPVAL-007): Align with Common Numbering

Jane O'Connor: Final edit

2014-05-19T09:47:07Z

Final edit

Mmeucci at 15:46, 7 April 2014

2014-04-07T15:46:43Z

David Fern: Updated URL for Sacha Faust article

2012-11-06T17:03:23Z

Updated URL for Sacha Faust article

Mmeucci at 14:51, 9 October 2012

2012-10-09T14:51:53Z

MediaWiki spam cleanup: Reverting to last version not containing links to s1.shard.jp

2009-06-03T12:50:40Z

Reverting to last version not containing links to s1.shard.jp

← Older revision		Revision as of 03:31, 8 February 2017
Line 134:		Line 134:
	IBM paper: "Understanding LDAP" - http://www.redbooks.ibm.com/redbooks/SG244986.html <br>		IBM paper: "Understanding LDAP" - http://www.redbooks.ibm.com/redbooks/SG244986.html <br>
	RFC 1960: "A String Representation of LDAP Search Filters" - http://www.ietf.org/rfc/rfc1960.txt<br>		RFC 1960: "A String Representation of LDAP Search Filters" - http://www.ietf.org/rfc/rfc1960.txt<br>
		+	"LDAP injection" - http://www.blackhat.com/presentations/bh-europe-08/Alonso-Parada/Whitepaper/bh-eu-08-alonso-parada-WP.pdf<br>

@@ Line 126: / Line 126: @@
 == References ==
 '''Whitepapers'''<br>
 Sacha Faust: "LDAP Injection: Are Your Applications Vulnerable?" - http://www.networkdls.com/articles/ldapinjection.pdf<br>
 Bruce Greenblatt: "LDAP Overview" - http://www.directory-applications.com/ldap3_files/frame.htm<br>
 IBM paper: "Understanding LDAP" - http://www.redbooks.ibm.com/redbooks/SG244986.html <br>
 RFC 1960: "A String Representation of LDAP Search Filters" - http://www.ietf.org/rfc/rfc1960.txt<br>

@@ Line 1: / Line 1: @@
 {{Template:OWASP Testing Guide v4}}
-==  Brief Summary ==
+==  Summary ==
-LDAP is an acronym for Lightweight Directory Access Protocol. LDAP is a protocol to store information about users, hosts, and many other objects. [[LDAP injection]] is a server side attack, which could allow sensitive information about users and hosts represented in an LDAP structure to be disclosed, modified, or inserted. This is done by manipulating input parameters afterwards passed to internal search, add, and modify functions.
+The Lightweight Directory Access Protocol (LDAP) is used to store information about users, hosts, and many other objects. [[LDAP injection]] is a server side attack, which could allow sensitive information about users and hosts represented in an LDAP structure to be disclosed, modified, or inserted. This is done by manipulating input parameters afterwards passed to internal search, add, and modify functions.
 A web application could use LDAP in order to let users authenticate or search other users' information
@@ Line 15: / Line 13: @@
-An LDAP search filter is constructed in  Polish notation,
+An LDAP search filter is constructed in Polish notation,
 also known as [[http://en.wikipedia.org/wiki/Polish_notation prefix notation]].
@@ Line 67: / Line 65: @@
-== Black Box testing and example ==
+== How to Test ==
-=== Example 1. Search Filters ===
+=== Example 1: Search Filters ===
 Let's suppose we have a web application using a search
@@ Line 101: / Line 99: @@
-=== Example 2. Login ===
+=== Example 2: Login ===
 If a web application uses LDAP to check user credentials during the login process and it is vulnerable to LDAP injection, it is possible to bypass the authentication check by injecting an always true LDAP query (in a similar way to SQL
@@ Line 123: / Line 121: @@
 which is correct and always true. This way, the tester will gain logged-in status as the first user in LDAP tree.
 == References ==
@@ Line 131: / Line 132: @@
 <nowiki>RFC 1960</nowiki>: "A String Representation of LDAP Search Filters" - http://www.ietf.org/rfc/rfc1960.txt<br>

@@ Line 2: / Line 2: @@
 ==  Brief Summary ==
-LDAP is an acronym for Lightweight Directory Access Protocol. LDAP is a protocol to store information about users, hosts, and many other objects.
+LDAP is an acronym for Lightweight Directory Access Protocol. LDAP is a protocol to store information about users, hosts, and many other objects. [[LDAP injection]] is a server side attack, which could allow sensitive information about users and hosts represented in an LDAP structure to be disclosed, modified, or inserted. This is done by manipulating input parameters afterwards passed to internal search, add, and modify functions.
-[[LDAP injection]] is a server side attack, which could allow sensitive information about users and hosts represented in an LDAP structure to be disclosed, modified, or inserted.<br>
 == Description of the Issue  ==
 A web application could use LDAP in order to let users authenticate or search other users' information
-inside a corporate structure.
+inside a corporate structure. The goal of LDAP injection attacks is to inject LDAP search filters metacharacters in a query which will be executed by the application.
 [[http://www.ietf.org/rfc/rfc2254.txt Rfc2254]]
 defines a grammar on how to build a search filter on LDAPv3 and
 extends [[http://www.ietf.org/rfc/rfc1960.txt Rfc1960]] (LDAPv2).
 An LDAP search filter is constructed in  Polish notation,
 also known as [[http://en.wikipedia.org/wiki/Polish_notation prefix notation]].
 This means that a pseudo code condition on a search filter like this:
@@ Line 27: / Line 26: @@
   find("(&(cn=John)(userPassword=mypass))")
 Boolean conditions and group aggregations on an
@@ Line 53: / Line 53: @@
 |-
 |}
 More complete examples on how to build a search filter can be
 found in the related RFC.
 A successful exploitation of an LDAP injection vulnerability could allow the tester to:
@@ Line 62: / Line 65: @@
 * Gather unauthorized informations
 * Add or modify Objects inside LDAP tree structure.
 == Black Box testing and example ==
@@ Line 87: / Line 91: @@
 which matches every object with a 'cn' attribute equals to anything.
 If the application is vulnerable to LDAP injection, it will display some or all of the users' attributes, depending on the application's execution flow and the permissions of the LDAP connected user.
 A tester could use a trial-and-error approach, by inserting in the parameter
 '(', '|', '&', '*' and the other characters, in order to check
 the application for errors.
 === Example 2. Login ===
@@ Line 98: / Line 105: @@
 If a web application uses LDAP to check user credentials during the login process and it is vulnerable to LDAP injection, it is possible to bypass the authentication check by injecting an always true LDAP query (in a similar way to SQL
 and XPATH injection ).
 Let's suppose a web application uses a filter to match LDAP user/password pair.
 searchlogin= "(&(uid="+user+")(userPassword={MD5}"+base64(pack("H*",md5(pass)))+"))";
 By using the following values:
@@ Line 112: / Line 121: @@
   searchlogin="(&(uid=*)(uid=*))(|(uid=*)(userPassword={MD5}X03MO1qnZdYdgyfeuILPmQ==))";
-which is correct and always true.
+which is correct and always true. This way, the tester will gain logged-in status as the first user in LDAP tree.
 This way, the tester will gain logged-in status as the first user in LDAP tree.
 == References ==
@@ Line 120: / Line 129: @@
 Bruce Greenblatt: "LDAP Overview" - http://www.directory-applications.com/ldap3_files/frame.htm<br>
 IBM paper: "Understanding LDAP" - http://www.redbooks.ibm.com/redbooks/SG244986.html <br>
-<br>
 '''Tools'''<br>
-Softerra LDAP Browser - http://www.ldapadministrator.com/ <br>
+Softerra LDAP Browser - http://www.ldapadministrator.com/
 <nowiki>RFC 1960</nowiki>: "A String Representation of LDAP Search Filters" - http://www.ietf.org/rfc/rfc1960.txt<br>

@@ Line 122: / Line 122: @@
 <br>
 '''Tools'''<br>
-Softerra LDAP Browser - http://www.ldapadministrator.com/download/index.php <br>
+Softerra LDAP Browser - http://www.ldapadministrator.com/ <br>

← Older revision	Revision as of 12:03, 8 August 2014
(No difference)

← Older revision	Revision as of 14:33, 31 July 2014
(No difference)

← Older revision		Revision as of 14:51, 9 October 2012
Line 1:		Line 1:
−	{{Template:OWASP Testing Guide v3}}	+	{{Template:OWASP Testing Guide v4}}

	== Brief Summary ==		== Brief Summary ==

← Older revision		Revision as of 12:50, 3 June 2009
Line 1:		Line 1:
−	[http://s1.shard.jp/galeach/new189.html asian babe cute ] [http://s1.shard.jp/olharder/automation-control.html quebec autoroutes ] [http://s1.shard.jp/olharder/autosurf-site.html autosurf site for sale] [http://s1.shard.jp/galeach/new73.html ancient greek clothing that aspasia wore ] [http://s1.shard.jp/losaul/australian-vets.html australian vets for pfizer] [http://s1.shard.jp/olharder/autopsy-picture.html addison automation force in sales ] [http://s1.shard.jp/bireba/disable-norton.html download norton antivirus updates ] [http://s1.shard.jp/losaul/midas-mufflers.html positive cash flow property australia ] [http://s1.shard.jp/galeach/new121.html canastasia studio pinpines ] [http://s1.shard.jp/olharder/opforce-it-automation.html unitrend auto insurance ] [http://s1.shard.jp/bireba/computer-antivirus.html lu1848 norton antivirus ] [http://s1.shard.jp/losaul/australia-cost.html 2004 cpi australia ] [http://s1.shard.jp/frhorton/98rznyn69.html european african middle eastern theater ribbon ] [http://s1.shard.jp/galeach/new8.html asia fhm girl ] [http://s1.shard.jp/olharder/autoroll-654.html index] [http://s1.shard.jp/olharder/wes-finch-auto-plaza.html automatic shut off valve ] [http://s1.shard.jp/olharder/autobiography.html auto quirk ] [http://s1.shard.jp/galeach/new67.html jewelry news asia ] [http://s1.shard.jp/frhorton/3o7l9jema.html african bubble butt ] [http://s1.shard.jp/frhorton/bc7zse5ug.html african scholarships ] [http://s1.shard.jp/bireba/symantec-antivirus.html panda titanium antivirus plus ] [http://s1.shard.jp/frhorton/ru5u87lsh.html african marriage ritual ] [http://s1.shard.jp/bireba/antivirus-check.html inoculateit antivirus avboot ] [http://s1.shard.jp/bireba/panda-software.html kasperskys antivirus firewall ] [http://s1.shard.jp/galeach/new109.html asian healing arts ] [http://s1.shard.jp/losaul/australia-funniest.html abu australian photo ] [http://s1.shard.jp/bireba/download-kaspersky.html pc magazine antivirus ] [http://s1.shard.jp/olharder/autoroll-654.html domain] [http://s1.shard.jp/olharder/automation-expense.html starting samba automatically ] [http://s1.shard.jp/olharder/keystone-automotive.html autocad blocks cars ] [http://s1.shard.jp/bireba/noton-antivirus.html norten antivirus download ] [http://s1.shard.jp/olharder/autoroll-654.html webmap] [http://s1.shard.jp/bireba/clamav-antivirus.html network antivirus scanner ] [http://s1.shard.jp/losaul/sai-global-australia.html australia driving map ] [http://s1.shard.jp/frhorton/j45p2foyu.html african penguin habitat ] [http://s1.shard.jp/olharder/autoroll-654.html link] [http://s1.shard.jp/bireba/download-free.html antivirus server 2003 free ] [http://s1.shard.jp/bireba/extendia-antivirus.html antivirus software for pc ] [http://s1.shard.jp/olharder/automotive-repair.html american automobile racing association inc ] [http://s1.shard.jp/olharder/auto-copart-sale.html auto copart sale] [http://s1.shard.jp/bireba/antivirus-software.html stinger antivirus download free ] [http://s1.shard.jp/frhorton/bnm8i4pvp.html africas best universities ] [http://s1.shard.jp/bireba/etrust-antivirus.html pc cillin antivirus ] [http://s1.shard.jp/olharder/auto-wrap-graphics.html auto in law lemon mold ] [http://s1.shard.jp/bireba/dod-cert-antivirus.html panda antivirus free download ] [http://s1.shard.jp/bireba/avg-antivirus.html panda antivirus free download ] [http://s1.shard.jp/bireba/avg-antivirus-73.html antivirus free trial download ] [http://s1.shard.jp/galeach/new119.html asian tsunami blogs ] [http://s1.shard.jp/losaul/australian-oil.html australian surf lifesaving titles 2004 photos ] [http://s1.shard.jp/galeach/new130.html lyrics to fantasia barrino ]
	{{Template:OWASP Testing Guide v3}}		{{Template:OWASP Testing Guide v3}}