LDAP injection is a specific form of attack that can be employed to compromise Web sites that
construct LDAP (Lightweight Directory Access Protocol) statements from data
provided by users. This is done by changing LDAP statements so dynamic Web applications can run
with invalid permissions, allowing the attacker to alter, add or delete content. LDAP is a protocol that
facilitates the location of organizations, individuals and other resources in a
network. It is a
streamlined version of DAP (Directory Access Protocol), which is part of X.500, a
standard for network directory
services.
LDAP injection works in much the same manner as SQL injection,
a type of security exploit in which the attacker adds SQL (Structured
Query Language) code to a Web form input box to gain access to resources or make changes to data.
According to security experts, the main reason that LDAP injection and similar exploits are on the
rise is the fact that security is not sufficiently emphasized in application development. To
protect the integrity of Web sites and applications, experts recommend the implementation of simple
precautions during development, such as controlling the types and numbers of characters that are
accepted by input boxes.
This was last updated in June 2006
Dig Deeper
-
Software consultant Nari Kannan describes how agile practices and work can be scaled appropriately for success in large organizations. Using lean thinking, reduction of waste, and appropriately organizing work and people, agile can be successfully adapted, regardless of the size of the organization.
-
Undiscovered software glitches in complex systems are common, and one of the primary drivers is the loss of mainframe knowledge of a retiring workforce. Software glitches are lurking in many large systems, particularly mainframe systems, and the COBOL programmers that understand the code best are retiring, according to Jeff Papows, author of the new book, "Glitch - The hidden impact of faulty software." Papows describes how faulty software caused a huge charge to debit card holder's account and why such mistakes are on the rise in this interview. Papows notes the three most pressing drivers for software glitches: loss of intellectual knowledge, market consolidation and the ubiquity of technology
-
Karen Johnson explains the situations in which SQL skills are important for a software tester as well as times when the expertise is not required.
-
People who read this also read...
-
Resources from around the Web