The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

Chapter 9 

■

Injecting Code

327

70779c09.qxd:WileyRed  9/14/07  3:13 PM  Page 327

---

Note the additional column containing the bogus attribute name 

cn;);cn

.

The LDAP query attributes are specified in a comma-delimited list, so every-

thing between the first and second comma is treated as an attribute name.

Note also that Active Directory will return an error if a completely arbitrary

attribute name is specified; however, it tolerates invalid names that start with

an actually valid name followed by a semicolon, hence the need to specify 

cn;

after the injected string.

Going further, you can specify any number of fields to be returned in the

results, and you can also specify an asterisk as the main search filter, which

functions as a wildcard. For example, supplying

*);cn,l,co,st,c,mail,cn;

will return all of these fields for every user, as shown in Figure 9-11.

Figure 9-11: An attack to retrieve all information in the directory