OWASP Hunting
Injection

LDAP Injection

LDAP injection manipulates LDAP queries by inserting special characters to bypass authentication, extract directory data, or enumerate users.

These payloads are for authorized testing only — systems you own, authorized bug bounty programs, or controlled lab environments. Unauthorized testing is illegal.

What it is

LDAP Injection occurs when an application constructs LDAP queries from unsanitized user input. An attacker can inject LDAP filter syntax to modify query logic, bypass authentication, or extract directory service entries. LDAP is widely used in enterprise environments for Active Directory authentication and directory lookups.

Attack Vectors

  • Login forms backed by LDAP/Active Directory
  • User search functionality querying a directory
  • HR or organizational chart applications
  • Enterprise SSO with LDAP integration

Testing Methodology

  1. Submit * as the username to match all directory entries
  2. Inject ) to close the current filter and add a new one
  3. Test with )(uid=*))(|(uid=* to bypass authentication
  4. Use * wildcards to enumerate valid usernames

Payloads

Reference payloads for authorized testing. Always verify you have permission before use.

Auth Bypass
**)(uid=*))(|(uid=**)(&*))%00admin)(&)admin)(|(password=*)
Filter Manipulation
)(cn=*)(|(objectclass=*)*))(objectclass=**))|
Attribute Enumeration
*(|(mail=*))*(|(objectclass=user))admin*

Indicators of Vulnerability

  • Authentication succeeds with * wildcard as username
  • LDAP error messages in response revealing filter syntax
  • Directory entries returned for wildcard queries

Detection Guidance

Monitor LDAP queries for wildcard characters and special metacharacters in user-supplied inputs. Log authentication attempts with unusual characters.

Mitigation & Remediation

  • Use parameterized LDAP query APIs that escape special characters
  • Validate and sanitize input: escape (, ), \, *, NUL characters
  • Apply principle of least privilege to LDAP service accounts
  • Use allowlists for expected username patterns

References

Responsible Use

All content in this reference is for authorized security testing only. Use only on systems you own or have explicit written permission to test.

  • Systems and applications you own
  • Authorized penetration testing engagements
  • Bug bounty programs with defined scope
  • Educational lab environments (DVWA, WebGoat, HackTheBox)