As we mentioned before on an old post, Ribadeo Hack Lab was invited to contribute with and article/paper for the new Hack In The Box magazine.

The article was about "LDAP Injection, attack and defense techniques".

You can get the ezine at: https://www.hackinthebox.org/misc/HITB-Ezine-Issue-001.pdf

You can get the original article (without ezine format) here

In order to write it, we used a lot of material, but not all of it was mentioned in the article.

Here you can find the whole reference used, with which you can gain full knowledge about LDAP in all aspects.

LDAP Basis & Protocol RFC's

• An Introduction to LDAP: http://ldapman.org/articles/intro_to_ldap.html
• Open LDAP: http://www.openldap.orgp
• LDAP standards and documents: http://www.mozilla.org/directory/standards.html
• Common LDAP RFCs: http://support.microsoft.com/?scid=kb%3Ben-us%3B221606&x=22&y=12
• Authentication on Linux Using Open LDAP: http://www.securityfocus.com/infocus/1428
• Tips for LDAP Users: http://java.sun.com/products/jndi/tutorial/ldap/index.html
• LDAP related bookmarks: http://delicious.com/tv/ldap
• How to write a LDAP search filter: http://confluence.atlassian.com/display/DEV/How+to+write+a+LDAP+search+filter
• LDAP Search Filter Syntax: http://msdn.microsoft.com/en-us/library/aa746475%28VS.85%29.aspx
• Microsoft OLE DB Provider for Microsoft Active Directory Service: http://msdn.microsoft.com/en-us/library/ms681571%28VS.85%29.aspx
• SQL Syntax with ADSI provider: http://www.rlmueller.net/SQLSyntax.htm
• Alternate Credentials with ADSI provider: http://www.rlmueller.net/ADOAltCredentials.htm

Other LDAP injection papers and articles

• LDAP Injection: http://www.owasp.org/index.php/LDAP_injection
• LDAP Injection: http://www.webappsec.org/projects/threat/classes/ldap_injection.shtml
• LDAP Injection & Blind LDAP injection in Web Applications: http://www.blackhat.com/presentations/bh-europe-08/Alonso-Parada/Whitepaper/bh-eu-08-alonso-parada-WP.pdf
• LDAP Injection y Blind LDAP injection paper: http://www.collecter.euitt.upm.es/cd/fullpapers/14/p75-LDAPInjectionYBlindLDAPInjection.pdf
• LDAP Injection & Blind LDAP Injection. Index I of III: http://elladodelmal.blogspot.com/2007/10/ldap-injection-blind-ldap-injection_9021.html
• LDAP Injection and Mitigation: http://blogs.msdn.com/securitytools/archive/2009/08/11/ldap-injection-and-mitigation.aspx
• LDAP Injection. Are your web applications vulnerable?: https://www.dsinet.org/files/textfiles/LDAPinjection.pdf
• What is LDAP injection?: http://blogs.sun.com/shankar/entry/what_is_ldap_injection
• LDAP Injection overview: http://weblogs.asp.net/dvravikanth/archive/2005/12/27/434036.aspx
• LDAP injections, reflexions: http://www.wzdftpd.net/blog/index.php?2008/02/07/5-ldap-injections-anyone
• Hacking Challenge solution using LDAP Injection (by RoMaNSoFt): http://www.rs-labs.com/papers/i64-reto_IV-solve.txt
• LDAP Injection y Blind LDAP injection article: http://foros.hackerss.com/t8411/ldap-injection-y-blind-ldap-injection
• Preventing LDAP Injection in Java: http://www.owasp.org/index.php/Preventing_LDAP_Injection_in_Java

LDAP Injection Exploits

• http://www.milw0rm.com/search.php?dong=LDAP
• http://www.exploit-db.com/list.php?description=LDAP

Applications using LDAP

• http://en.wikipedia.org/wiki/List_of_LDAP_software
• http://koders.com/default.aspx?s=ldap&submit=Search&la=*&li=*

LDAP Injection tools

• W3AF: http://w3af.sourceforge.net/
• WFuzz: http://www.edge-security.com/wfuzz.php
• JBroFuzz: http://www.owasp.org/index.php/Category:OWASP_JBroFuzz
• LDAPinjector: http://www.informatica64.com/foca/download/ldapInjector_0_2_1_0.zip
• Wapiti: http://wapiti.sourceforge.net
• wsScanner and Web2Fuzz: http://blueinfy.com/tools.html

Character encoding

• http://www.w3schools.com/TAGS/ref_urlencode.asp
• http://en.wikipedia.org/wiki/Percent-encoding
• A few of the gotchas of MultiByteToWideChar: http://blogs.msdn.com/michkap/archive/2005/04/19/409566.aspx
• What the &%#$ does MB_USEGLYPHCHARS do?: http://blogs.msdn.com/michkap/archive/2005/02/26/381020.aspx

SQL Injection

• http://pentestit.com/tag/sql-injection/
• http://www.owasp.org/index.php/SQL_Injection
• http://unixwiz.net/techtips/sql-injection.html

LDAP with python

• http://www.python-ldap.org/docs.shtml
• http://www.linuxjournal.com/node/6988/print
• http://www.ibm.com/developerworks/aix/library/au-ldap_crud/
• http://eagain.net/talks/ldaptor/
• http://webmail.inoi.fi/open/trac/ldaptor