hunt-ldap

Send a single unbalanced parenthesis in the username field and compare the response to a captured baseline. A filter-syntax error or 500 on the unbalanced input but not on balanced input indicates the input reaches an LDAP filter unescaped.

Blind exfiltration uses a boolean oracle: pair a known-true filter with a known-false filter to establish response classes, then test each character position with a wildcard suffix. Repeat each positive character three times and re-verify the false control to rule out length jitter.

No. Active Directory stores passwords in unicodePwd, which is write-only and never returned by searches. Against AD the win is enumeration of sAMAccountName, memberOf, and description fields; hash exfiltration via userPassword only works on non-AD directories like OpenLDAP or 389-DS.

Search-filter injection places input inside an (attr=VALUE) filter where * ( ) & | ! are meaningful. DN injection places input inside a Distinguished Name where , = + " \ < > ; and / matter and * is not a wildcard. Payloads do not transfer between the two contexts.

The resulting full filter has unbalanced parentheses. Count opening minus closing parentheses in the final concatenated filter, including whatever the application appends after your input, and adjust trailing parentheses so the complete string is balanced.

XPath has no comment syntax, so you cannot truncate the rest of the query with --. Payloads must keep quotes and brackets balanced, using expressions like ' or '1'='1 or node-dumping constructs like x'] | //user/* | //user[name()='x.