This is an old revision of this page, as edited by Melcous(talk | contribs) at 01:51, 9 December 2016(Added {{context}}, {{dead end}}, {{notability}} and {{unreferenced}} tags (within {{multiple issues}}), and {{uncategorized}} tag to article (TW)). The present address (URL) is a permanent link to this revision, which may differ significantly from the current revision.Revision as of 01:51, 9 December 2016 by Melcous(talk | contribs)(Added {{context}}, {{dead end}}, {{notability}} and {{unreferenced}} tags (within {{multiple issues}}), and {{uncategorized}} tag to article (TW))
LDAP (Lightweight Direct Access Protocol) injection is a code injection technique used to exploit web based applications which could reveal sensitive user information or modify information represented in the LDAP structure. LDAP injection exploits a security vulnerability in an application by manipulating input parameters passed to internal search, add or modify functions. When an application fails to properly sanitize the input, it is possible for an attacker to modify a LDAP statement.
Technical Implementation
LDAP injection occurs when user input it not properly sanitized and then used as part of a dynamically generated LDAP filter. This results in potential manipulation of the LDAP statements performed on the LDAP server by the end-user to either view, modify, or bypass authentication credentials.
Prevention
LDAP injection is a known attack and can be prevented by simple measures. All of the client supplied input must be checked/sanitized of any characters that may result in malicious behavior. The input validation should verify the input by checking for the presence of special characters that are a part of the LDAP query language, known data types, legal values, etc.. White list input validation can also be used to detect unauthorized input before it is passed to the LDAP query.
This article has not been added to any content categories. Please help out by adding categories to it so that it can be listed with similar articles. (December 2016)
