# LDAP Injection

> Detects LDAP queries constructed from user input without proper escaping, enabling authentication bypass and data exfiltration.

- Skill: `zakirkun/ldap-injection` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add zakirkun/ldap-injection`
- Raw SKILL.md: https://api.skillmd.com/api/skills/zakirkun/ldap-injection/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: zakirkun (https://skillmd.com/u/zakirkun)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/zakirkun/ldap-injection

---


# LDAP Injection

## Overview
LDAP injection occurs when user-controlled input is incorporated into LDAP search filters without sanitization. Attackers can:
- Bypass authentication by injecting `*)(uid=*))(|(uid=*`
- Enumerate directory entries
- Access unauthorized data

## Detection Strategy
Look for LDAP filter strings built via string concatenation or format strings containing request parameters.

## Remediation
Use LDAP escaping functions to sanitize input before including in filters.

**Vulnerable (Java):**
```java
String filter = "(&(uid=" + username + ")(userPassword=" + password + "))";
DirContext ctx = new InitialDirContext(env);
ctx.search(baseDN, filter, controls);
```

**Safe (Java):**
```java
String filter = "(&(uid={0})(userPassword={1}))";
// Use parameterized search with MessageFormat or escaping
String safeFilter = "(&(uid=" + LdapEncoder.encode(username) + "))";
```