Skip to main content

We use cookies to ensure you get the best user experience. For more information see our cookie policy.

Back to all walkthroughs
Room Icon

LDAP Injection

Premium room

Exploiting Lightweight Directory Access Protocol.

easy

38 min

12,125

User profile photo.
User profile photo.

To access material, start machines and answer questions login.

Set up your virtual environment

To successfully complete this room, you'll need to set up your virtual environment. This involves starting both your AttackBox (if you're not using your VPN) and Lab Machines, ensuring you're equipped with the necessary tools and access to tackle the challenges ahead.
Attacker machine
Status:Off
Lab machine
Status:Off

Introduction

, which stands for Lightweight Directory Access Protocol, is a widely used protocol for accessing and maintaining distributed directory information services over an Internet Protocol (IP) network. LDAP enables organizations to manage users centrally, as well as groups and other directory information, often used for authentication and authorization purposes in web and internal applications.

Objectives

  1. Provide a thorough understanding of LDAP and its role in directory services.
  2. Explore the LDAP tree structure and its key components.
  3. Introduce LDAP Injection, its impact, and how it can be exploited.
  4. Equip participants with the knowledge and skills to identify and mitigate LDAP Injection vulnerabilities.

Pre-requisites

  1. A foundational understanding of how directory services work, particularly LDAP.
  2. Basic knowledge of web application security principles and common vulnerabilities.
  3. Familiarity with the structure and components of LDAP, such as Distinguished Names () and attributes.
  4. Experience with tools and techniques for security testing of web applications, such as or .
Answer the questions below
Deploy the target VM attached to this task by pressing the green Start Lab Machine button. We will use the machine's generated IP address later at the end of the room. You can access the VM using your VPN connection or the AttackBox.