LDAP Injection Protection

Protection Module: LdapInjection

Prevents LDAP injection attacks through query validation and input sanitization.

Available for:

• ASP.NET Core
• ASP.NET Framework
• Windows Services

How It Works

LDAP Injection Protection validates LDAP queries to prevent unauthorized directory access or manipulation.

Detection Methods:

• Special Character Detection - Identifies *, (, ), \, |, &
• Filter Injection Analysis - Detects malicious filter modifications
• DN Injection Detection - Validates Distinguished Name syntax
• Boolean Operator Abuse - Identifies &, |, ! injection
• Wildcard Exploitation - Detects unauthorized * usage

Common Attack Patterns:

• Authentication bypass (*)(uid=*))(|(uid=*)
• Privilege escalation (injecting admin groups)
• Data exfiltration (wildcard searches)
• Filter modification ()(objectClass=*))

Configuration

{
  "protections": {
    "LdapInjection": {
      "enabled": true,
      "action": "block"
    }
  }
}

{
  "protections": {
    "LdapInjection": {
      "enabled": true,
      "action": "block"
    }
  }
}

ASP.NET Core

builder.Services.AddBytehideMonitor(monitor => monitor
    .WithProtection(ProtectionModuleType.LdapInjection, ActionType.Block)
);

builder.Services.AddBytehideMonitor(monitor => monitor
    .WithProtection(ProtectionModuleType.LdapInjection, ActionType.Block)
);

Attack Examples

Authentication Bypass

// Input: *)(uid=*))(|(uid=*
// Filter: (&(uid=*)(uid=*))(|(uid=*)(userPassword=*))
// Status: BLOCKED

// Input: *)(uid=*))(|(uid=*
// Filter: (&(uid=*)(uid=*))(|(uid=*)(userPassword=*))
// Status: BLOCKED

Filter Injection

// Input: admin)(|(uid=*
// Filter: (&(uid=admin)(|(uid=*)(userPassword=*))
// Status: BLOCKED

// Input: admin)(|(uid=*
// Filter: (&(uid=admin)(|(uid=*)(userPassword=*))
// Status: BLOCKED

Wildcard Exploitation

// Input: *
// Filter: (uid=*)
// Status: BLOCKED (unauthorized wildcard)

// Input: *
// Filter: (uid=*)
// Status: BLOCKED (unauthorized wildcard)

Platform Compatibility

Related Protections

• SQL Injection
• NoSQL Injection