hunt-ldap

# HUNT-LDAP — LDAP Injection & XPath Injection > Grounding note: LDAP injection is rarely disclosed with verbatim payloads on > public platforms (most live on internal-pentest reports). This skill is > grounded in the **OWASP LDAP Injection Prevention / Testing Guide > (WSTG-INPV-06)**, **PortSwigger Web Security Academy (LDAP injection)**, and > the **RFC 4515** filter grammar — all publicly verifiable references rather > than invented HackerOne IDs. Do not cite a report you cannot link. ## Crown Jewel Targets LDAP injection that bypasses authentication = **Critical**. Blind attribute exfiltration of credentials/secrets = **High**. AD enumeration alone = Medium-High. **Highest-value chains:** - **LDAP auth bypass** — close the `uid` filter and append an always-true OR so the bind/search returns the admin entry without a valid password. - **Blind attribute exfil** — char-by-char extraction of an attribute value via a boolean oracle (login success/failure, result count, or response length). - **userPassword hash exfil (non-AD only)** — on OpenLDAP/389-DS the `userPassword` attribute can hold `{SSHA}`/`{CRYPT}` hashes that ARE readable by query. See the AD-vs-generic warning below. - **XPath injection auth bypass** — `' or '1'='1` against XML-backed auth. --- ## CRITICAL — Active Directory vs generic LDAP Do **not** conflate the two. They behave very differently: | | Generic LDAP (OpenLDAP, 389-DS, ApacheDS) | Active Directory | |---|---|---| | Password attribut...