webPromedium
Lab 330 — AuthVault — Blind LDAP Injection in Directory Lookup
hackadvisor
Task: Identity management platform with public LDAP directory lookup, flag hidden in admin's description attribute not returned by API. Solution: Blind boolean-based LDAP injection in username parameter to extract description attribute character by character using wildcard matching.
$ ls tags/ techniques/
nodejsexpresscharacter_extractionboolean_basedldapldap_injectionopenldapdecoy_flagblind_ldap_injectiondirectory_lookupanti_bot_trap
ldap_filter_injectiondecoy_flag_identificationblind_ldap_injectionboolean_based_extractionldap_wildcard_matchingparallel_character_bruteforce
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Sign in with GitHub to continue. No email required.
$sign in$ grep --similar
Similar writeups
- [web][Pro]Lab 303 — DevGateway — Broken Access Control in Admin API— hackadvisor
- [web][Pro]Lab 331 — PeopleDir — LDAP Injection Authentication Bypass— hackadvisor
- [web][Pro]Lab 116 — InsightForge — IDOR via Undocumented Internal API— hackadvisor
- [web][Pro]Lab 326 — PulseBoard — NoSQL Injection in Authentication— hackadvisor
- [web][Pro]Directory— volgactf