the-web-application-hackers-handbook

350 Chapter 9 n Attacking Data Stores
Common examples of LDAP are the Active Directory used within Windows
domains, and OpenLDAP, used in various situations. You are most likely to
encounter LDAP being used in corporate intranet-based web applications, such
as an HR application that allows users to view and modify information about
employees.
Each LDAP query uses one or more search filters, which determine the directory
entries that are returned by the query. Search filters can use various logical
operators to represent complex search conditions. The most common search
filters you are likely to encounter are as follows:
n Simple match conditions match on the value of a single attribute. For
example, an application function that searches for a user via his username
might use this filter:
(username=daf)
n Disjunctive queries specify multiple conditions, any one of which must
be satisfied by entries that are returned. For example, a search function
that looks up a user-supplied search term in several directory attributes
might use this filter:
(|(cn=searchterm)(sn=searchterm)(ou=searchterm))
n Conjunctive queries specify multiple conditions, all of which must be
satisfied by entries that are returned. For example, a login mechanism
implemented in LDAP might use this filter:
(&(username=daf)(password=secret)
As with other forms of injection, if user-supplied input is inserted into an
LDAP search filter without any validation, it may be possible for an attacker
to supply crafted input that modifies the filter’s structure and thereby retrieve
data or perform actions in an unauthorized way.
In general, LDAP injection vulnerabilities are not as readily exploitable as
SQL injection flaws, due to the following factors:
n Where the search filter employs a logical operator to specify a conjunctive
or disjunctive query, this usually appears before the point where usersupplied
data is inserted and therefore cannot be modified. Hence, simple
match conditions and conjunctive queries don’t have an equivalent to the
“or 1=1” type of attack that arises with SQL injection.
n In the LDAP implementations that are in common use, the directory attributes
to be returned are passed to the LDAP APIs as a separate parameter
from the search filter and normally are hard-coded within the application.