LDAP Injection Bug Bounty Guide: Filters, Auth, and Blind Cases

LDAP Injection Bug Bounty Guide: Filters, Auth, and Blind Cases

LDAP injection appears when user input is pasted into an LDAP filter. Directories power enterprise login, group membership, and employee search. Break the filter, and you may authenticate as someone else or pull attributes you should not see.

CWE-90 covers this class. OWASP still lists it because corporate apps keep wiring login forms straight into (&(uid=USER)(userPassword=PASS)) style filters.

High-value surfaces

• Corporate login / VPN portal / legacy intranet auth
• “Find employee” search boxes
• Group membership checks before authorizing an admin feature
• Password-reset flows that look up accounts by email in LDAP

Cloud-native apps use managed IdPs more often now, so LDAP bugs cluster on enterprise and B2B targets. Read the scope — some programs exclude third-party IdPs.

Payloads that teach you the grammar

Filters use parentheses and operators like &, |, !. A quotation break might look different from SQL. Common probes:

• * for wildcards in some filter positions
• Injecting ) to close a clause early
• admin)(&) style constructions that alter logic (validate on labs first)

True/false pairs matter. Login as a known-valid user with a wrong password vs a payload that short-circuits the password clause — compare outcomes carefully and stay inside rate limits.

Blind LDAP injection

Often you get no error text. You get “login failed” vs a redirect, or a search that returns zero vs many rows. Use that oracle to extract characters from cn, mail, or membership attributes when the program allows slow, low-volume testing.

Automate gently. Directories and lockout policies are unforgiving.

Writing the report

Explain the filter you believe you influenced, show the exact input, and demonstrate impact:

• Auth bypass, or
• Unauthorized attribute disclosure, or
• Membership check bypass granting a privileged function

Attach directory-relevant context: “this portal gates access to internal tooling via LDAP groups.”

Defense notes worth including

Use LDAP encoding APIs for filter escaping, prefer bind-based authentication over filter-compared passwords where appropriate, and apply least-privilege service accounts.

LDAP injection is not dead; it moved behind employee-facing portals. When you see directory-driven auth on an in-scope host, test the filter like you would test SQL — patiently, with boolean oracles, and with lockout awareness.