hunt-ldap

1# HUNT-LDAP — LDAP Injection & XPath Injection
2 
3> Grounding note: LDAP injection is rarely disclosed with verbatim payloads on
4> public platforms (most live on internal-pentest reports). This skill is
5> grounded in the **OWASP LDAP Injection Prevention / Testing Guide
6> (WSTG-INPV-06)**, **PortSwigger Web Security Academy (LDAP injection)**, and
7> the **RFC 4515** filter grammar — all publicly verifiable references rather
8> than invented HackerOne IDs. Do not cite a report you cannot link.
9 
10## Crown Jewel Targets
11 
12LDAP injection that bypasses authentication = **Critical**. Blind attribute
13exfiltration of credentials/secrets = **High**. AD enumeration alone = Medium-High.
14 
15**Highest-value chains:**
16- **LDAP auth bypass** — close the `uid` filter and append an always-true OR so the
17  bind/search returns the admin entry without a valid password.
18- **Blind attribute exfil** — char-by-char extraction of an attribute value via a
19  boolean oracle (login success/failure, result count, or response length).
20- **userPassword hash exfil (non-AD only)** — on OpenLDAP/389-DS the
21  `userPassword` attribute can hold `{SSHA}`/`{CRYPT}` hashes that ARE readable
22  by query. See the AD-vs-generic warning below.
23- **XPath injection auth bypass** — `' or '1'='1` against XML-backed auth.
24 
25---
26 
27## CRITICAL — Active Directory vs generic LDAP
28 
29Do **not** conflate the two. They behave very differently:
30 
31| | Generic LDAP (OpenLDAP, 389-DS, ApacheDS) | Active Directory |
32|---|---|---|
33…