domains / families / security / hunt-ldap

hunt-ldap

authentic

Hunt LDAP Injection and XPath Injection — authentication bypass, blind char-by-char attribute exfiltration, AD user/group enumeration, XML-store XPath bypass. Covers the LDAP special-character set (* ( ) \\ NUL /), search-filter-context vs DN-injection, parenthesis-balancing, AND/OR filter logic, and {SSHA}/{CRYPT} userPassword exfil on non-AD directories. Use when target uses LDAP/AD authentication, corporate SSO with a directory backend, an address-book/people-search API, or XML-based data stores queried with XPath.

When to use

• LDAP Injection
• XPath Injection
• authentication bypass
• blind char-by-char attribute exfiltration
• AD user/group enumeration
• XML-store XPath bypass
• userPassword hash exfil on non-AD directories

When not to use

• AD password hash dumping

Skill page

Source