LDAP Injection

• Attack that exploits applications that build LDAP statements based on user input

• Exploits non-validated web input that passes LDAP queries

• Attacker can inject code to do all kinds of things

• Attacker changes what is entered into the form field by adding characters )(&) after the username and then providing any password

• Example:

# & symbol ends the query 
(&(USER=Matt)(PASSWORD=MyPwd!))

# Any password will work when ending an LDAP query 
(&(USER=Matt)(&)(PASSWORD=Anything))