hunt-ldap

Hunt LDAP Injection and XPath Injection — authentication bypass, blind char-by-char attribute exfiltration, AD user/group enumeration, XML-store XPath bypass. Covers the LDAP special-character set (* ( ) \ NUL /), search-filter-context vs DN-injection, parenthesis-balancing, AND/OR filter logic, and {SSHA}/{CRYPT} userPassword exfil on non-AD directories. Use when target uses LDAP/AD authentication, corporate SSO with a directory backend, an address-book/people-search API, or XML-based data stores queried with XPath.

Quality

94%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Quality

Content

88%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is highly actionable with executable payloads and a well-sequenced, validation-rich methodology. Its main weakness is the absence of progressive disclosure: all content lives in one long file rather than being split into referenced bundle files.

Suggestions

Split the payload arrays (LDAP and XPath) and the chain table into a referenced references/ file (e.g. PAYLOADS.md) to apply progressive disclosure and shorten SKILL.md.

Consolidate the repeated AD-vs-generic hash-exfil warning into a single CRITICAL section and remove the restatements in the Chain Table footer and Validation list.

Trim the RFC 4515 filter-grammar primer to only the load-bearing parenthesis-balancing rule, since the prefix-notation explanation largely restates knowledge Claude already has.

Dimension	Reasoning	Score
Conciseness	Mostly efficient and operational with little conceptual padding, but the AD-vs-generic hash-exfil warning is restated in three places and the RFC 4515 grammar primer reiterates knowledge Claude partly holds, so a few sections could be trimmed.	4 / 5
Actionability	Provides copy-paste-ready bash/curl payloads, executable probe and char-by-char exfil loops, concrete payload arrays, ldapsearch validation, and specific hashcat modes covering the common cases.	5 / 5
Workflow Clarity	A clear six-phase sequence is paired with an explicit validation checklist and feedback loops (true/false controls, repeat-3x confirmation, FALSE-control re-checks), satisfying the destructive-skill validation requirement.	5 / 5
Progressive Disclosure	Internal section structure is clear and well-organized, but the skill is a ~300-line monolithic SKILL.md with no bundle files or one-level-deep references to offload the payload arrays and chain table.	4 / 5
	Total	18 / 20 Passed

Description

100%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is comprehensive and well-structured, clearly stating both the concrete capabilities and the precise contexts in which to invoke the skill. Trigger terms are natural and specific to the LDAP/XPath domain.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions — authentication bypass, blind char-by-char exfiltration, AD enumeration, XPath bypass — plus technical specifics like the special-character set and parenthesis-balancing, matching the comprehensive-coverage anchor.	5 / 5
Completeness	Explicitly answers both what (the four hunt techniques and coverage areas) and when via a concrete 'Use when...' clause with multiple trigger surfaces.	5 / 5
Trigger Term Quality	Includes natural trigger phrases users would say ('LDAP/AD authentication', 'corporate SSO with a directory backend', 'address-book/people-search API', 'XML-based data stores') with synonyms, matching the comprehensive-coverage anchor.	5 / 5
Distinctiveness Conflict Risk	Occupies a clear LDAP/XPath-injection niche with directory-auth/SSO/address-book triggers, giving it minimal overlap with generic web or SQLi skills.	5 / 5
	Total	20 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: elementalsouls/Claude-BugHunter
Path: skills/hunt-ldap/SKILL.md
Commit: 58017df

Reviewed: 3 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.