The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

Finding LDAP Injection Flaws

Supplying invalid input to an LDAP operation typically does not result in any

informative error message. In general, the evidence available to you in diag-

nosing a vulnerability includes the results returned by a search function, and

the occurrence of an error such as an HTTP 500 status code. Nevertheless, you

can use the following steps to identify an LDAP injection flaw with a degree of

reliability.

Chapter 9 

■

Injecting Code

329

70779c09.qxd:WileyRed  9/14/07  3:13 PM  Page 329

---

330

Chapter 9 

■

Injecting Code

HACK STEPS 

■

Try entering just the 

*

character as a search term. This character functions