The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

Figure 9-9: An LDAP-based directory search function

326

Chapter 9 

■

Injecting Code

70779c09.qxd:WileyRed  9/14/07  3:13 PM  Page 326

---

When a user supplies the search term 

GUILL

, the application performs the

following LDAP query:

;(givenName=GUILL);cn,telephoneNumber,department

This query contains two key elements:

■■

The search filter:

givenName=GUILL

■■

The attributes to be returned:

cn,telephoneNumber,department

In this situation, it is possible for an attacker to supply a crafted search term

that interferes with one or both of these elements, to modify the information

returned by the query.

Injecting Query Attributes

To retrieve other attributes in the query’s results, you must first terminate the

brackets that encapsulate the search filter and then specify the additional

attributes that you desire. For example, supplying

GUILL);mail,cn;

results in the query

;(givenName=GUILL);mail,cn;);cn,telephoneNumber,

department

which returns an additional column containing the user’s email address, as

shown in Figure 9-10.

Figure 9-10: Injecting an additional query attribute