Welcome to Kenny-s Blog

LDAP injection

LDAP injection is a type of security attack that is used to compromise Web sites that construct LDAP (Lightweight Directory Access Protocol) statements from data provided by users. LDAP is a protocol that facilitates the location of organizations, individuals and other resources in a network. It is a streamlined version of DAP (Directory Access Protocol), which is part of X.500, a standard for network directory services that can be used for authentication.

Download this free guide

Learn the 10 skills of highly effective software testers

Without strong analytical and problem-solving skills, software testers will not succeed and projects may fail. Baiju M. looks at 10 skills all software testers should have, and expert Matt Heusser explains how to be a more technical tester.

By submitting your personal information, you agree that TechTarget and its partners may contact you regarding relevant content, products and special offers.

You also agree that your personal information may be transferred and processed in the United States, and that you have read and agree to the Terms of Use and the Privacy Policy.

LDAP injection works in much the same manner as SQL injection, a type of security exploit in which the attacker adds SQL (Structured Query Language) code to a Web form. With LDAP injections, the attacker places code in a user input field to gain unauthorized access to the directory database. This can be done by changing LDAP statements so dynamic Web applications run with invalid permissions. Once in, the attacker can view usernames and passwords in the directory database or grant themselves administrator privileges.

According to security experts, the main reason that LDAP injection and similar exploits work is the fact that security is not sufficiently emphasized in application development. To protect the integrity of Web sites and applications, experts recommend the implementation of security precautions during development, sanitizing input to control the types and numbers of characters that can be accepted by input boxes and using multi-factor authentication (MFA) for public-facing applications.

Have something to add? Share it in the comments.

Your email address will not be published. Required fields are marked *