2

I want to check several techniques for LDAP injection, but I cannot find a vulnerable application (like Webgoat, Hacme etc.) which uses LDAP injection.

Do you know of any vulnerable web application which includes LDAP Injection? If not, do you know of any other example application that uses LDAP so I can make it vulnerable and test against it?

Boaz Tirosh
  • 633
  • 2
  • 7
  • 18

2 Answers2

3

It is better to learn from a real world vulnerability than one that was engineered.

Bugzilla can be configured to use LDAP for authentication and it was vulnerable to LDAP Injection. This is ideal because LDAP authentication bypass is the archetypal attack.

In general I recommend searching the CVE database for these types of flaws and then finding the vulnerable version. This shouldn't be too hard with open source projects, because they usually give you access to source control and there for every version of the application.

rook
  • 46,916
  • 10
  • 92
  • 181
  • I +1 you because this is a great answer. The missing (and irrelevant) piece of information I failed to mention is that I need to use this as a demonstration in front of a class, as part of a course Im giving - this is why Im looking for engineered application, Otherwise your answer would be excellent. – Boaz Tirosh Oct 23 '12 at 19:17
  • 1
    @Boaz Tirosh A demonstration is the best place to show a real attack. – rook Oct 23 '12 at 19:19
0

There are few apps, which can be exploited now or have been previously and that was either disclosed or not, some of them are required to be configured for LDAP, and the injection doesnt always require user to be authenticated. These apps are any apps which are using LDAP, but highly possibly vulnerable ones are:

  1. Openfiler - very often configured with LDAP

  2. Horde/Imp - same as openfiler

  3. Windows Active Directory apps using LDAP (actually, the native windows library doesnt do any checks, so you can pass lot's of rubbish via SDK to the windows server causing very many different responses and errors - including 2008 R2 and Server 2012).

  4. Google Apps

Generally, you are very likely to actually find some exploitable bugs with LDAP, because many apps are not working with it by default, so admins configure LDAP themselves in a very insecure ways, that with the simple injection you can either get all users, but also change password of the admin. Since many apps are not tested with LDAP by default, it's very likely, that once you will enable LDAP, you will find many issues.

Andrew Smith
  • 1
  • 1
  • 6
  • 19