Questions tagged [ldap-injection]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
1
vote
1answer
28 views

Partially controlling LDAP BindDN parameter

In an application I was assessing, I found an interesting piece of code that took my attacker-supplied input and put it into the bindDN while preparing to connect to an LDAP server. [USERNAME]@domain....
2
votes
2answers
1k views

C# LDAP Injection

Will the C# DirectoryEntry class vulnerable to LDAP Injection from the parameters of it constructor? For example: DirectoryEntry de = new DirectoryEntry(path, username, txtPassword.Text, ...
0
votes
1answer
622 views

.net System.Security.Principal.WindowsPrincipal user namespace ldap injection

A recent scan of a .net web application detected an ldap injection vulnerability for a field that was used for a username assigned to an instance of a custom class named User. After stepping through ...
2
votes
2answers
1k views

Vuln Web App which includes LDAP Injection?

I want to check several techniques for LDAP injection, but I cannot find a vulnerable application (like Webgoat, Hacme etc.) which uses LDAP injection. Do you know of any vulnerable web application ...
4
votes
2answers
8k views

How do I sanitize LDAP input and prevent injection attacks? What LDAP injection scenarios are possible?

In the following C# example I'm querying AD's configuration container for Exchange overrides. If the domain name in unsanitised the end user could get LDAP to read a different object then intended. ...