LDAP:
Exploitation
Anonymous bind, injection, pass-back, brute force, and credential extractio
LDAP Brute Force and Password Spraying
Exploit LDAP authentication via brute force and password spraying techniques to enumerate valid credentials against directory services.
LDAP Credential Extraction – LAPS gMSA and Hidden Passwords
Exploits LDAP misconfigurations to extract LAPS passwords, gMSA credentials, and hidden attributes using tools like ldapsearch, BloodHound, and CrackMapExec.
LDAP Pass-Back Attack – Credential Capture via Rogue Server
Exploit misconfigured LDAP authentication by redirecting credentials to a rogue server, capturing plaintext or hashed bind credentials during reconnection attempts.
LDAP exploitation uses the directory service itself as an attack vector. Techniques include LDAP injection in web applications that construct queries from user input, passback attacks to capture credentials by redirecting LDAP authentication to an attacker-controlled server, and extracting sensitive data through crafted LDAP queries.
The subpages cover each attack in detail, from injection syntax to setting up rogue LDAP servers for credential capture.