Questions tagged [ldap-injection]
The ldap-injection tag has no usage guidance.
6
questions
1
vote
1
answer
399
views
How to exploit LDAP injection? [closed]
BurpSuite marked a website I am testing with having a potential LDAP injection vulnerability. It seems that when I put an asterisk in a parameter ex. getStuff?id=* I get a 500 error and Java error ...
- 11
2
votes
1
answer
147
views
Partially controlling LDAP BindDN parameter
In an application I was assessing, I found an interesting piece of code that took my attacker-supplied input and put it into the bindDN while preparing to connect to an LDAP server.
[USERNAME]@domain....
- 259
2
votes
2
answers
2k
views
C# LDAP Injection
Will the C# DirectoryEntry class vulnerable to LDAP Injection from the parameters of it constructor?
For example:
DirectoryEntry de = new DirectoryEntry(path, username, txtPassword.Text, ...
- 361
0
votes
1
answer
770
views
.net System.Security.Principal.WindowsPrincipal user namespace ldap injection
A recent scan of a .net web application detected an ldap injection vulnerability for a field that was used for a username assigned to an instance of a custom class named User.
After stepping through ...
- 109
2
votes
2
answers
1k
views
Vuln Web App which includes LDAP Injection?
I want to check several techniques for LDAP injection, but I cannot find a vulnerable application (like Webgoat, Hacme etc.) which uses LDAP injection.
Do you know of any vulnerable web application ...
- 633
5
votes
2
answers
11k
views
How do I sanitize LDAP input and prevent injection attacks? What LDAP injection scenarios are possible?
In the following C# example I'm querying AD's configuration container for Exchange overrides. If the domain name in unsanitised the end user could get LDAP to read a different object then intended.
...
- 50.7k