Which attack method exploits websites that construct LDAP statements from user-supplied input?

Which attack method exploits websites that construct LDAP statements from user-supplied input?

• A. Shell Injection
• B. LDAP Injection
• C. HTML Embedding
• D. File Injection Attack

Answer: (B)

LDAP Injection happens when a web application builds LDAP queries directly from user input without proper sanitization. LDAP queries use filters in parentheses, like (uid=theUser). If an attacker can inject special characters or logic into that input, they can alter the query’s structure and behavior, potentially bypassing authentication or extracting unintended data. This differs from shell, HTML, or file injection, which target command execution, web page content, or file paths respectively. To defend, validate and escape LDAP metacharacters, and prefer parameterized queries or binding so user input is treated as data rather than part of the LDAP command.

LDAP Injection happens when a web application builds LDAP queries directly from user input without proper sanitization. LDAP queries use filters in parentheses, like (uid=theUser). If an attacker can inject special characters or logic into that input, they can alter the query’s structure and behavior, potentially bypassing authentication or extracting unintended data. This differs from shell, HTML, or file injection, which target command execution, web page content, or file paths respectively. To defend, validate and escape LDAP metacharacters, and prefer parameterized queries or binding so user input is treated as data rather than part of the LDAP command.