Skip to content
HackIndex logo

HackIndex

LDAP Null Bind and Anonymous Access

3 min read May 15, 2026

Anonymous LDAP access — also called null bind — allows unauthenticated clients to query the directory. On Active Directory this is disabled by default in modern builds but still present in legacy environments and misconfigured DCs. On OpenLDAP and other directory servers it is often intentionally configured but scoped too broadly. This page confirms the vulnerability exists and documents its impact — exploitation is covered in LDAP Anonymous Bind Exploitation.

Confirming null bind

A null bind succeeds when the server accepts a bind request with an empty DN and empty password. The key difference from a failed bind is that the server returns data rather than an error.

┌──(kali㉿kali)-[~]
└─$ # Method 1 — ldapsearch with -x (simple auth) and no credentials
┌──(kali㉿kali)-[~]
└─$ ldapsearch -x -H ldap://$TARGET_IP -s base namingContexts
 
┌──(kali㉿kali)-[~]
└─$ # Success: returns naming context data
┌──(kali㉿kali)-[~]
└─$ # Failure: result: 1 Operations error OR result: 50 Insufficient access rights
 
┌──(kali㉿kali)-[~]
└─$ # Method 2 — bind with explicit empty DN and password
┌──(kali㉿kali)-[~]
└─$ ldapsearch -x -H ldap://$TARGET_IP -D '' -w '' -s base
 
┌──(kali㉿kali)-[~]
└─$ # Method 3 — nmap script
┌──(kali㉿kali)-[~]
└─$ nmap -p 389 --script ldap-rootdse $TARGET_IP
 
┌──(kali㉿kali)-[~]
└─$ # Method 4 — nxc
┌──(kali㉿kali)-[~]
└─$ nxc ldap $TARGET_IP -u '' -p '' 
# VULNERABLE — null bind succeeds:
namingContexts: DC=corp,DC=local
result: 0 Success

# NOT VULNERABLE — null bind rejected:
result: 1 Operations error
text: 000004DC: LdapErr: DSID-0C09075A, comment: In order to perform this operation a successful bind must be completed

Determining scope of anonymous access

Confirming null bind succeeds is only the first step. The scope of what is readable varies significantly between servers. Document exactly what is exposed.

┌──(kali㉿kali)-[~]
└─$ # Can we read user objects?
┌──(kali㉿kali)-[~]
└─$ ldapsearch -x -H ldap://$TARGET_IP -b "$BASE_DN" "(objectClass=user)" sAMAccountName 2>&1 | head -20
 
┌──(kali㉿kali)-[~]
└─$ # Can we read group objects?
┌──(kali㉿kali)-[~]
└─$ ldapsearch -x -H ldap://$TARGET_IP -b "$BASE_DN" "(objectClass=group)" cn 2>&1 | head -20
 
┌──(kali㉿kali)-[~]
└─$ # Can we read computer objects?
┌──(kali㉿kali)-[~]
└─$ ldapsearch -x -H ldap://$TARGET_IP -b "$BASE_DN" "(objectClass=computer)" dNSHostName 2>&1 | head -20
 
┌──(kali㉿kali)-[~]
└─$ # Can we read sensitive attributes?
┌──(kali㉿kali)-[~]
└─$ ldapsearch -x -H ldap://$TARGET_IP -b "$BASE_DN" "(objectClass=user)" userPassword unixUserPassword ms-MCS-AdmPwd 2>&1 | grep -v "^#" | grep -v "^$"
 
┌──(kali㉿kali)-[~]
└─$ # Count total readable objects
┌──(kali㉿kali)-[~]
└─$ ldapsearch -x -H ldap://$TARGET_IP -b "$BASE_DN" "(objectClass=*)" dn 2>&1 | grep "^dn:" | wc -l

OpenLDAP specific checks

OpenLDAP servers often have anonymous access configured intentionally but scoped incorrectly. These additional checks apply to non-AD LDAP servers.

┌──(kali㉿kali)-[~]
└─$ # Read server configuration (slapd)
┌──(kali㉿kali)-[~]
└─$ ldapsearch -x -H ldap://$TARGET_IP -s base -b "cn=config"
 
┌──(kali㉿kali)-[~]
└─$ # Check for userPassword attribute readable anonymously
┌──(kali㉿kali)-[~]
└─$ ldapsearch -x -H ldap://$TARGET_IP -b "$BASE_DN" "(objectClass=posixAccount)" userPassword
 
┌──(kali㉿kali)-[~]
└─$ # Check for shadowPassword
┌──(kali㉿kali)-[~]
└─$ ldapsearch -x -H ldap://$TARGET_IP -b "$BASE_DN" "(objectClass=shadowAccount)" shadowPassword
 
┌──(kali㉿kali)-[~]
└─$ # Full posixAccount dump (Linux users)
┌──(kali㉿kali)-[~]
└─$ ldapsearch -x -H ldap://$TARGET_IP -b "$BASE_DN" "(objectClass=posixAccount)" uid uidNumber gidNumber homeDirectory loginShell userPassword

Impact classification

  • Null bind allowed, user objects readable → valid username list for AD Password Spraying and AS-REP Roastable Account Enumeration without credentials

  • Null bind allowed, password policy readable → determines lockout risk before any credential attack

  • Null bind allowed, description attributes readable → often contains plaintext credentials

  • Null bind allowed, userPassword readable → direct credential extraction, passwords may be plaintext or weakly hashed

  • Null bind allowed, full directory tree readable → complete domain enumeration without authentication

For exploitation of all of these paths see LDAP Anonymous Bind Exploitation.