what is LDAP Injection?

LDAP Injection

"LDAP(Lightweight Directory Access Protocol) Injection is a way to exploit in LDAP databases, which fails to sanitize or validate user's input at the client-side. This Injection is similar to SQL Injection but prior exploitation than SQL injection though uses the same method to exploit with databases and with LDAP directory structure."

LDAP which stands for Lightweight Directory Access Protocol is a protocol used to access the directory on a server in web browser applications to search, connect, and modify data on a server. It is based on TCP/IP, and It works on client-server technology. The LDAP injection is designed to exploit in databases and directories where LDAP fails to sanitize input given by the user to authorize themselves on the client-side.

LDAP injection works in a similar way with SQL injection but SQL injection has some advanced features than LDAP injection. Both are used to inject queries into databases. LDAP injection can authorize invalid SQL commands and changes in the LDAP tree after exploitation. A hacker first of all test application's vulnerability and then they exploit for unsolicited use.

How to protect it?

The only solution to protect is, use client-side validations to validate the user's input like username and password, just to check the user is not inserting any special characters like *, /*/, */, . and so forth. If the user is injecting any data like I described, block the user at the client-side and do not let them hit your LDAP directory or database.

You can watch out this video for a better understanding.

Please keep learning from computerflicks, because it is beyond computing.