Questions tagged [ldap-injection]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
1 vote
1 answer

How to exploit LDAP injection? [closed]

BurpSuite marked a website I am testing with having a potential LDAP injection vulnerability. It seems that when I put an asterisk in a parameter ex. getStuff?id=* I get a 500 error and Java error ...
user8098132's user avatar
2 votes
1 answer

Partially controlling LDAP BindDN parameter

In an application I was assessing, I found an interesting piece of code that took my attacker-supplied input and put it into the bindDN while preparing to connect to an LDAP server. [USERNAME]@domain....
Rob Gates's user avatar
  • 259
2 votes
2 answers

C# LDAP Injection

Will the C# DirectoryEntry class vulnerable to LDAP Injection from the parameters of it constructor? For example: DirectoryEntry de = new DirectoryEntry(path, username, txtPassword.Text, ...
overshadow's user avatar
0 votes
1 answer

.net System.Security.Principal.WindowsPrincipal user namespace ldap injection

A recent scan of a .net web application detected an ldap injection vulnerability for a field that was used for a username assigned to an instance of a custom class named User. After stepping through ...
tuson's user avatar
  • 109
2 votes
2 answers

Vuln Web App which includes LDAP Injection?

I want to check several techniques for LDAP injection, but I cannot find a vulnerable application (like Webgoat, Hacme etc.) which uses LDAP injection. Do you know of any vulnerable web application ...
Boaz Tirosh's user avatar
5 votes
2 answers

How do I sanitize LDAP input and prevent injection attacks? What LDAP injection scenarios are possible?

In the following C# example I'm querying AD's configuration container for Exchange overrides. If the domain name in unsanitised the end user could get LDAP to read a different object then intended. ...
makerofthings7's user avatar