KARIM ASHRAF SPACE.
  • Who Am I ?
  • WRITEUPS
    • What about Practice in Cyber Security?
    • Dark Side of VSCode
    • What about Cy-nix Machine?
    • Cyberdefenders Labs
      • Web Investigation Blue Team Lab
      • Red Stealer Blue Team Lab
      • WebStrike Blue Team Lab
      • BlueSky Ransomware Blue Team Lab
      • PsExec Hunt Blue Team Lab
      • OpenWire Blue Team Lab
      • 3CX Supply Chain Blue Team Lab
      • PoisonedCredentials Lab
      • Reveal Lab
    • Lets Defend
      • Incident Responder Path
        • Cybersecurity Incident Handling Guide
          • Introduction to Incident Handling
          • Incident Handling Steps
          • Preparation
          • Detection and Analysis
          • Containment, Eradication, and Recovery
          • Post-Incident Activity
        • Incident Response on Windows
          • How to Create Incident Response Plan?
          • Incident Response Procedure
          • 3 Important Things
          • Free Tools That Can Be Used
          • Live Memory Analysis
          • Task Scheduler
          • Services
          • Registry Run Keys / Startup Folder
          • Files
          • Checklist
        • Incident Response on Linux
          • How to Create Incident Response Plan?
          • Incident Response Procedure
          • 3 Important Things
          • Users and Groups
          • Processes
          • Files and File System
          • Mounts
          • Network
          • Service
          • Cron Job
          • SSH Authorized Keys
          • Bash_rc & Bash_profile
          • Useful Log Files
        • Hacked Web Server Analysis
          • Introduction to Hacked Web Server Analysis
          • Log Analysis on Web Servers
          • Attacks on Web Servers
          • Attacks Against Web Applications
          • Vulnerabilities on Servers
          • Vulnerabilities in Programming Language
          • Discovering the Web Shell
          • Hacked Web Server Analysis Example
        • Log Analysis with Sysmon
          • Introduction and Set Up of Sysmon
          • Detecting Mimikatz with Sysmon
          • Detecting Pass The Hash with Sysmon
          • Detecting Privilege Escalation with Sysmon
        • Forensic Acquisition and Triage
          • Introduction to Forensics Acquisition and Triage
          • Acquiring Memory Image From Windows and Linux
          • Custom Image Using FTK and Mounting Image for Analysis
          • KAPE Targets for Acquisition
          • KAPE Modules for Triage and Analysis
          • Triage Using FireEye Redline
          • Acquisition and Triage of Disks Using Autopsy
        • Memory Forensics
          • What is Memory Forensics
          • Memory Analysis Procedures
        • Registry Forensics
          • Introduction to Windows Registry Forensics
          • Acquiring Registry Hives
          • Regedit and Registry Explorer
          • System, Users and Network Information
          • Shellbags
          • Shimcache
          • Amcache
          • Recent Files
          • Dialogue Boxes MRU
        • Event Log Analysis
          • Introduction to Event Logs
          • Event Log Analysis
          • Authentication Event Logs
          • Windows Scheduled Tasks Event Logs
          • Windows Services Event Logs
          • Account Management Events
          • Event Log Manipulation
          • Windows Firewall Event Logs
          • Windows Defender Event Logs
          • Powershell Command Execution Event logs
        • Browser Forensics
          • Introduction to Browser Forensics
          • Acquisition
          • Browser Artifacts
          • Tool: BrowsingHistoryView
          • Manual Browser Analysis
          • Hindsight Framework
        • GTFOBins
          • Introduction to GTFOBins
          • Shell
          • Command
          • Reverse Shell
          • Bind Shell
          • File Upload
          • File Download
          • Sudo
        • Hunting AD Attacks
          • Introduction to Active Directory
          • Hunting AS-REP Roasting Attack
          • Hunting for Kerberoasting Attacks
          • Hunting for LDAP Enumerations (Bloodhound_Sharphound)
          • Hunting for NTDS Database Dumping
          • Hunting for Golden Ticket Attacks
          • Hunting for NTLM Relay Attacks
        • Writing a Report on Security Incident
          • Introduction to Technical Writing
          • Reporting Standards
          • Reporting Style
          • Report Formatting
          • Report Templates
        • How to Prepare a Cyber Crisis Management Pla
          • Introduction to Crisis Management
          • General Preparation
          • Tools
          • Backups
          • Alerts and End of Crisis
        • Advanced Event Log Analysis
          • Process Creation
          • DNS Activity
          • File/Folder Monitoring
          • BITS Client Event Log
          • Network Connections Event Log
          • MSI Event Logs
        • USB Forensics
          • Introduction to USB Forensics
          • USB Registry Key
          • USB Event Logs
          • Folder Access Analysis via Shellbags
          • File Access Analysis via Jumplists
          • Automated USB Parsers Tools
        • Windows Disk Forensics
          • SRUM Database
          • Jumplists
          • Recycle Bin Artifacts
          • RDP Cache
          • Thumbnail Cache
    • BTLO LABS
      • Bruteforce BTLO
    • The Complete Active Directory Security Handbook
      • Introduction
      • Active Directory
      • Attack Technique 1: Pass the Hash: Use of Alternate Authentication Material (T1550)
      • Attack Technique 2: Pass the Ticket: Use of Alternate Authentication Material (T1550)
      • Attack Technique 3: Kerberoasting
      • Attack Technique 4: Golden Ticket Attack
      • Attack Technique 5: DCShadow Attack
      • Attack Technique 6: AS-REP Roasting
      • Attack Technique 7: LDAP Injection Attack
      • Attack Technique 8: PetitPotam NTLM Relay Attack on a Active Directory Certificate Services (AD CS)
      • Conclusion & References
    • Windows Privilege Escalation
      • Tools
      • Windows Version and Configuration
      • User Enumeration
      • Network Enumeration
      • Antivirus Enumeration
      • Default Writeable Folders
      • EoP - Looting for passwords
      • EoP - Incorrect permissions in services
      • EoP - Windows Subsystem for Linux (WSL)
      • EoP - Unquoted Service Paths
      • EoP - $PATH Interception
      • EoP - Named Pipes
      • EoP - Kernel Exploitation
      • EoP - AlwaysInstallElevated
      • EoP - Insecure GUI apps
      • EoP - Evaluating Vulnerable Drivers
      • EoP - Printers
      • EoP - Runas
      • EoP - Abusing Shadow Copies
      • EoP - From local administrator to NT SYSTEM
      • EoP - Living Off The Land Binaries and Scripts
      • EoP - Impersonation Privileges
      • EoP - Privileged File Write
      • References
      • Practical Labs
    • Advanced Log Analysis
      • Key Windows Event IDs for Cybersecurity Monitoring
      • Analyzing a Series of Failed Login Attempts from Multiple IP Addresses
      • Steps to Investigate Suspicious Outbound Network Traffic
      • Identifying and Responding to Lateral Movement within a Network
      • Distinguishing Between Legitimate and Malicious PowerShell Executions
      • Detecting and Analyzing a Potential Data Exfiltration Incident Using Log Data
      • Steps to Analyze PowerShell Logging (Event ID 4104) for Malicious Activity
      • How to Identify an Internal Pivot Attack Using Log Data
      • Indicators in Logs Suggesting a Privilege Escalation Attack
      • How to Detect Command and Control (C2) Communication Using Log Analysis
      • How to Analyze Logs to Detect a Brute-Force Attack on an RDP Service
      • How to Analyze Logs to Detect a Brute-Force Attack on an RDP Service
      • How to Detect the Use of Living-Off-the-Land Binaries (LOLBins) in Logs
      • How to Detect Malware Masquerading as a Legitimate Process Using Log Analysis
      • How to Detect and Analyze Lateral Movement Using Windows Event Logs
      • How to Detect Potential Ransomware Attacks in Their Early Stages Using Log Analysis
      • How to Detect and Analyze Privilege Escalation Using Windows Event Logs
      • How to Detect the Use of Mimikatz or Similar Tools in Log Data
      • How to Detect and Analyze DNS Tunneling Through Log Analysis
      • How to Detect a Pass-the-Hash (PtH) Attack Using Logs
      • How to Detect and Analyze an Attacker’s Use of a Remote Access Trojan (RAT) Using Log Data
      • How to Detect Lateral Movement Using Windows Event Logs
      • How to Detect and Investigate Data Exfiltration Using Logs
      • How to Identify and Analyze an Internal Phishing Campaign Using Email and System Logs
      • How to Detect and Analyze Ransomware Activity Using Logs
      • How to Detect Malicious PowerShell Activity Using Log Analysis
      • How to Detect and Respond to Brute-Force Attacks Using Log Data
      • How to Detect Privilege Escalation Attempts Using Windows Event Logs
      • How to Detect and Analyze Suspicious Domain Name Resolution Requests in DNS Logs
      • How to Detect and Respond to Unauthorized Access to Critical Files
      • How to Detect and Analyze Suspicious PowerShell Command Execution
      • How to Detect and Investigate Account Takeover (ATO) Attempts Using
      • How to Detect and Analyze the Use of Living Off the Land Binaries (LOLBins)
      • How to Detect and Investigate Lateral Movement
      • How to Detect and Investigate Data Exfiltration
      • How to Detect and Analyze Suspicious Activity Involving Service Accounts
      • How to Detect and Investigate Anomalous PowerShell Activity Related to Credential Dumping
      • How to Detect and Analyze the Execution of Unsigned or Malicious Executables
      • How to Detect and Investigate Abnormal Spikes in Network Traffic
    • Methods for Stealing Password in Browser
      • Important Tables and Columns
      • Important Queries
      • Profiles
      • Tools
        • HackBrowserData
        • Browser-password-stealer
        • BrowserPass
        • WebBrowserPassView
        • Infornito
        • Hindsight
        • BrowserFreak
        • BrowserStealer
    • Hack The Box Tracks
      • Soc Analyst Path 2024
        • 1. Incident Handling Process
          • Incident Handling Definition & Scope
          • Incident Handling's Value & Generic Notes
          • Cyber Kill Chain
          • Incident Handling Process Overview
          • Preparation Stage (Part 1)
          • Preparation Stage (Part 2)
          • DMARC
          • Endpoint Hardening (& EDR)
          • Network Protection
          • Privilege Identity Management / MFA / Passwords
          • Vulnerability Scanning
          • User Awareness Training
          • Active Directory Security Assessment
          • Purple Team Exercises
          • Detection & Analysis Stage (Part 1)
          • Initial Investigation
          • Incident Severity & Extent Questions
          • Incident Confidentiality & Communication
          • Detection & Analysis Stage (Part 2)
          • The Investigation
          • Initial Investigation Data
          • Creation & Usage Of IOCs
          • Identification Of New Leads & Impacted Systems
          • Data Collection & Analysis From The New Leads & Impacted Systems
          • Containment
          • Eradication
          • Recovery
          • Post-Incident Activity Stage
          • Reporting
        • 2. Security Monitoring & SIEM Fundamentals
          • What Is SIEM?
          • The Evolution Of SIEM And How It Works
          • SIEM Business Requirements & Use Cases Log Aggregation & Normalization
          • Data Flows Within A SIEM
          • What Are The Benefits Of Using A SIEM Solution
          • What Is the Elastic Stack?
          • The Elastic Stack As A SIEM Solution
          • How To Identify The Available Data
          • The Elastic Common Schema (ECS)
          • SOC Definition & Fundamentals
          • Evolution of Security Operations Centers (SOCs)
          • What Is MITRE ATT&CK?
          • What Is A SIEM Use Case?
          • How To Build SIEM Use Cases
          • SIEM Visualization Example 1: Failed Logon Attempts (All Users)
          • SIEM Visualization Example 2: Failed Logon Attempts (Disabled Users)
          • SIEM Visualization Example 3: Successful RDP Logon Related To Service Accounts
          • SIEM Visualization Example 4: Users Added or Removed from a Local Group
          • What Is Alert Triaging?
  • COURSES SUMMARY
    • TCM SEC
      • TCM linux Privilege Escalation
      • TCM OSINT
    • The SecOps Group
      • Certified AppSec Practitioner exam
      • CNSP Review
    • Cybrary
      • Cybrary Offensive Pentesting
  • TIPS&TRICKS
    • Windows Shorcuts Arrow Remover
    • Kali KEX
    • Intel TurboBoost
    • Pentest_Copilot
    • Ferdium
    • Youtube Adblock_Bybass
    • Burb-Bambdas
    • Burb Customizer
    • BetterFox
Powered by GitBook
On this page
  • LDAP Injection Attack: Overview, Techniques, and Mitigation Strategies
  • Introduction to LDAP
  • Attack Technique: LDAP Injection
  • LDAP Injection Types and Examples
  • 1. Privilege Escalation
  • 2. Access Control Bypass
  • 3. Information Disclosure
  • Mitigation Techniques for LDAP Injection
  • 1. Escaping Input Variables
  • 2. Distinguished Name (DN) Escaping
  • 3. Search Filter Escaping
  • Additional Defenses Against LDAP Injection
  • 1. Least Privilege Principle for Binding Accounts
  • 2. Enable Secure Bind Authentication
  • 3. Allow-List Input Validation
  • Conclusion
  1. WRITEUPS
  2. The Complete Active Directory Security Handbook

Attack Technique 7: LDAP Injection Attack

LDAP Injection Attack: Overview, Techniques, and Mitigation Strategies


Introduction to LDAP

Lightweight Directory Access Protocol (LDAP) is an open-source application protocol designed for directory services authentication and information retrieval. It provides a standardized communication interface between applications and directory services like Microsoft Active Directory (AD).

Key Points:

  • LDAP is a protocol, not a directory service itself.

  • Microsoft Active Directory (AD) uses LDAP to facilitate authentication and data retrieval within a network.

  • LDAP Queries: These are used to retrieve information such as user attributes or group memberships. For example, querying users with “Password never expires” enabled:

    (objectcategory=user)(userAccountControl:1.2.840.113556.1.4.803:=65536)

Attack Technique: LDAP Injection

LDAP Injection is a vulnerability that arises when user input is improperly sanitized before being incorporated into an LDAP query. This allows attackers to manipulate queries and execute unauthorized commands or access sensitive data.

Vulnerability Mechanism

  • Injection Methodology: Attackers append malicious input to LDAP queries, leveraging special characters like *, (, or ).

  • Consequences:

    • Privilege Escalation: Unauthorized access to restricted information.

    • Access Control Bypass: Bypass login mechanisms.

    • Information Disclosure: Access sensitive user or directory data.


LDAP Injection Types and Examples

1. Privilege Escalation

Goal: Gain access to restricted directories or data.

Scenario:

  • A low-privileged user attempts to access secure documents stored in a restricted directory.

Injection Technique:

Information)(security_level=*))(&(directory=documents

Resulting Query:

(&(directory=Information)(security_level=*))(&(directory=Information)(security_level=low))

Explanation:

  • The query allows access to all documents with any security level (security_level=*), bypassing the intended restriction.


2. Access Control Bypass

Goal: Log in without valid credentials.

Scenario:

  • Login authentication query for user "Alice":

    (&(USER=Alice)(PASSWORD=PaSsW0rd!))

Injection Technique:

USER=Alice)(PASSWORD=*))(&

Resulting Query:

(&(USER=Alice)(PASSWORD=*))(&)

Explanation:

  • The query always evaluates to true for username "Alice," bypassing password validation.


3. Information Disclosure

Goal: Retrieve unauthorized data.

Scenario:

  • A product search query:

    (|(type=Notebooks)(type=Stickers))

Injection Technique:

uid=*

Resulting Query:

(|(type=Notebooks)(uid=*))(type=Stickers))

Explanation:

  • The query exposes all user accounts (uid=*), disclosing sensitive directory information.


Mitigation Techniques for LDAP Injection

To safeguard against LDAP injection, organizations must adopt comprehensive input validation and query construction practices.

1. Escaping Input Variables

Proper encoding of user inputs ensures that special characters are sanitized, preventing them from altering query logic.

Implementation:

  • Use LDAP-specific encoding libraries to escape input.

  • Avoid custom encoding logic to reduce the risk of improper sanitization.

Purpose: Prevent unauthorized input from altering LDAP query structures.


2. Distinguished Name (DN) Escaping

Distinguished Names (DNs) are unique identifiers within LDAP. Special characters within DNs, such as \, #, ,, and +, must be escaped to avoid query manipulation.

Example:

cn=John Doe, ou=Engineering, dc=example, dc=com

Risk:

  • Unescaped special characters may cause misinterpretation or unauthorized data access.

Best Practice:

  • Use built-in DN escaping functions in LDAP libraries.


3. Search Filter Escaping

LDAP search filters rely on precise query logic. Characters like *, (, and ) must be escaped to maintain query integrity.

Example:

  • A filter to find entries with specific managers:

    (&(ou=Physics)(|(manager=Freeman Dyson)(manager=Albert Einstein)))

Purpose:

  • Ensure that input within search filters does not introduce unauthorized logic.


Additional Defenses Against LDAP Injection

1. Least Privilege Principle for Binding Accounts

Binding Accounts are used to authenticate and execute queries within LDAP. Reducing their permissions minimizes potential damage.

Implementation:

  • Grant only the permissions required for specific tasks.

  • Regularly audit and review permissions.

Purpose: Restrict the scope of compromised accounts.


2. Enable Secure Bind Authentication

Bind Authentication verifies user credentials during LDAP access.

Secure Options:

  • Use Simple Authentication and Security Layer (SASL) for secure binding.

  • Disable Anonymous and Unauthenticated Bind to prevent unauthorized access.

Purpose: Strengthen access controls by ensuring secure authentication.


3. Allow-List Input Validation

Implement allow-listing to restrict inputs to predefined, safe values.

Techniques:

  • Use regular expressions for pattern matching.

  • Enforce length and data type restrictions.

  • Cross-reference inputs with known safe values.

Purpose: Prevent injection of unauthorized data into LDAP queries.


Conclusion

LDAP Injection is a significant security vulnerability that can lead to unauthorized access, privilege escalation, and information disclosure. By exploiting improperly sanitized inputs, attackers can manipulate LDAP queries and compromise sensitive directory data.

To defend against LDAP Injection:

  1. Sanitize and escape user inputs in all LDAP queries.

  2. Enforce the principle of least privilege for binding accounts.

  3. Implement secure binding and input validation techniques.

By adopting these mitigation strategies, organizations can strengthen their LDAP security and reduce the risk of exploitation, ensuring the integrity and confidentiality of their directory services.

PreviousAttack Technique 6: AS-REP RoastingNextAttack Technique 8: PetitPotam NTLM Relay Attack on a Active Directory Certificate Services (AD CS)

Last updated 5 months ago