wildhunter logo
The arsenal

Payloads.

Pick a vulnerability class, learn how to hunt it step by step, grab the payloads that actually work. Curated from PayloadsAllTheThings — the full section is linked under every class.

SQL InjectionXSSSSRFCommand InjectionSSTIFile Inclusion (LFI)Path TraversalInsecure DeserializationNoSQL InjectionGraphQLJWTCORSRequest SmugglingOpen RedirectFile UploadIDOROAuthAccount TakeoverRace ConditionCRLF InjectionCSRFLDAP InjectionXXEWeb Cache Deception

LDAP Injection

LDAP statements built from user input let you rewrite the query filters — auth bypass and directory-wide data extraction. Enterprise SSO, AD-backed logins, and directory searches are the hunting ground.

Severity guide

High on auth bypass (login as any user); medium-high on directory data extraction; often paired with weak rate limits in enterprise environments.

Where to look

entry points to test first

01

LDAP-backed login forms

Corporate/SSO logins (Active Directory, OpenLDAP) — errors mentioning DN or filter syntax are giveaways.

02

Directory/user search

Employee finders, org charts, address books — filters built from free text.

03

Group/permission checks

Authorization middleware querying group membership by username.

04

Profile attribute lookups

Endpoints fetching user records by email/uid strings.

05

Older enterprise apps

Java/PHP stacks with ldap_search() and string-built filters.

How to hunt it

in order, start to finish

  1. Detect LDAP-backed auth

    Login forms on enterprise stacks (AD, OpenLDAP). Errors mentioning distinguished names or filter syntax are giveaways.

  2. Break the filter

    Inject *)( into the username — if the query completes differently, your input lands inside the LDAP filter.

  3. Force the match

    user = *)(uid=*))(|(uid=* makes the filter match everything — authentication bypass with any password.

  4. Extract attributes

    Blind cycles on mail, userPassword, givenName — the same oracle pattern as blind SQLi.

  5. Map the directory

    objectClass and attribute-name enumeration (mail, surname, cn) reveals the directory structure — useful for chaining into other enterprise bugs.

Filter & validation bypasses

when your first tries get blocked
  • 01Filter escaping present? AND/OR logic injection ((!(&(1=0))) restructures even escaped filters.
  • 02Login-only testing? Search endpoints are often less protected than auth — start there.
  • 03Blind only? Boolean oracles via response differences and attribute-name error leaks both work.
  • 04Special chars blocked? LDAPv3 escape sequences (\2a for *) re-form the wildcards.

Impact ladder

what makes it payable
  1. 01Authentication bypass — login as any directory user.
  2. 02Directory enumeration — extract the whole org's user data.
  3. 03Attribute extraction — emails, phone numbers, password hashes (with extended match rules).
  4. 04Chain into VPN/SSO compromise — directory data feeds credential attacks.

Payloads

4 · from PayloadsAllTheThings
user = *)(uid=*))(|(uid=*

Filter-rewriting injection — matches every directory entry.

user = admin)(!(&(1=0

Admin-targeted filter break — forces the admin match despite the password clause.

pass = q))

Password-side filter break — closes the query early.

userPassword:2.5.13.18:=\xx

Matching-rule OID abuse for attribute extraction.

Toolsmanual testing only
Full LDAP Injection section ↗

Payload strings, code and technical terms are shown in English on purpose — payloads must be copied exactly as published.

Payloads originate from PayloadsAllTheThings (MIT) — use them only on programs you're authorized to test.

Payloads — wildhunter