Hunt Ldap
Hunt LDAP Injection and XPath Injection, authentication bypass, blind char-by-char...
Install
npx skills add elementalsouls/Claude-BugHunter --skill hunt-ldap -g -a claude-code -y- Repository
- elementalsouls/Claude-BugHunter5.4k
- Category
- Engineering
- Updated
- 3d ago
- License
- MIT
- Context cost
- Mediumabout 3,000 tokens
- Runs scripts
- No, instructions only
What it does
Hunt LDAP Injection and XPath Injection, authentication bypass, blind char-by-char attribute exfiltration, AD user/group enumeration, XML-store XPath bypass. Covers the LDAP special-character set (* ( ) \\ NUL /), search-filter-context vs DN-injection, parenthesis-balancing, AND/OR filter logic, and {SSHA}/{CRYPT} userPassword exfil on non-AD directories. Use when target uses LDAP/AD authentication, corporate SSO with a directory backend, an address-book/people-search API, or XML-based data stores queried with XPath.
HUNT-LDAP, LDAP Injection & XPath Injection
Grounding note: LDAP injection is rarely disclosed with verbatim payloads on public platforms (most live on internal-pentest reports). This skill is grounded in the OWASP LDAP Injection Prevention / Testing Guide (WSTG-INPV-06), PortSwigger Web Security Academy (LDAP injection), and the RFC 4515 filter grammar, all publicly verifiable references rather than invented HackerOne IDs. Do not cite a report you cannot link.
Crown Jewel Targets
LDAP injection that bypasses authentication = Critical. Blind attribute exfiltration of credentials/secrets = High. AD enumeration alone = Medium-High.
Highest-value chains:
- LDAP auth bypass, close the
uidfilter and append an always-true OR so the bind/search returns the admin entry without a valid password. - Blind attribute exfil, char-by-char extraction of an attribute value via a boolean oracle (login success/failure, result count, or response length).
- userPassword hash exfil (non-AD only), on OpenLDAP/389-DS the
userPasswordattribute can hold{SSHA}/{CRYPT}hashes that ARE readable by query. See the AD-vs-generic warning below. - XPath injection auth bypass,
' or '1'='1against XML-backed auth.
CRITICAL, Active Directory vs generic LDAP
Do not conflate the two. They behave very differently:
| Generic LDAP (OpenLDAP, 389-DS, ApacheDS) | Active Directory | |
|---|---|---|
| Password attribute | userPassword, may hold {SSHA}/{MD5}/{CRYPT} and is readable if ACL allows | unicodePwd, write-only, never returned by any search |
| Hash exfil via injection | Possible where ACLs leak userPassword | Not possible, there is no readable hash attribute over LDAP |
| Useful enum attrs | uid, cn, mail, userPassword | sAMAccountName, userPrincipalName, mail, memberOf, description (often holds plaintext secrets!) |
