LDAP injection is a specific form of attack that can be employed to compromise Web sites that
construct LDAP
(Lightweight Directory Access Protocol) statements from data provided by users. This is done by
changing LDAP statements so dynamic Web applications can run with invalid permissions, allowing the
attacker to alter, add or delete content. LDAP is a protocol that facilitates the
location of organizations, individuals and other resources in a network. It is a streamlined
version of DAP (Directory Access Protocol), which is part of X.500, a standard for network directory services.
LDAP injection works in much the same manner as SQL injection, a
type of security exploit in which the attacker adds SQL (Structured Query Language)
code to a Web form input box to gain access to resources or make changes to data. According to
security experts, the main reason that LDAP injection and similar exploits are on the rise is the
fact that security is not sufficiently emphasized in application development. To protect the
integrity of Web sites and applications, experts recommend the implementation of simple precautions
during development, such as controlling the types and numbers of characters that are accepted by
input boxes.
This was last updated in June 2006
Email Alerts
Register now to receive SearchSoftwareQuality.com-related news, tips and more, delivered to your inbox.
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States.
Privacy
More News and Tutorials
-
Software consultant Nari Kannan describes how agile practices and work can be scaled appropriately for success in large organizations. Using lean thinking, reduction of waste, and appropriately organizing work and people, agile can be successfully adapted, regardless of the size of the organization.
-
Undiscovered software glitches in complex systems are common, and one of the primary drivers is the loss of mainframe knowledge of a retiring workforce. Software glitches are lurking in many large systems, particularly mainframe systems, and the COBOL programmers that understand the code best are retiring, according to Jeff Papows, author of the new book, "Glitch - The hidden impact of faulty software." Papows describes how faulty software caused a huge charge to debit card holder's account and why such mistakes are on the rise in this interview. Papows notes the three most pressing drivers for software glitches: loss of intellectual knowledge, market consolidation and the ubiquity of technology
-
Karen Johnson suggests a variety of ways that testers can gain additional skills and experience, including social networking and open source testing.
-
Articles
-
Resources from around the Web
