LDAP Security Assessment

This guide treats LDAP directories and directory-integrated applications as a control boundary rather than a list of attack commands. First document who owns it, who should reach it, what identity context applies, and which data or downstream systems it can affect.

• Confirmed asset owner and in-scope address or application.
• Expected clients, identities, and network zones.
• Protocol versions, encryption expectations, and authentication mode.
• Sensitive data classes and downstream dependencies.
• Monitoring owner, escalation contact, and agreed stop threshold.

1. 01

   Identify directory owners, naming contexts, replicas, and approved client networks.

2. 02

   Record simple bind, SASL, LDAPS, and StartTLS expectations.

3. 03

   Define designated users and synthetic directory objects.

4. 04

   Map application service accounts and required search bases.

ldapsearch -x -H ldap://192.0.2.10 \
+  -s base -b "" namingContexts supportedLDAPVersion

A useful result demonstrates a broken security expectation with a reversible, low-impact test. Scanner labels and version matches are leads; validate the actual control and preserve the clean baseline beside the changed request.

1. 01

   Request only root DSE or approved synthetic objects during initial checks.

2. 02

   Confirm anonymous and unauthenticated binds match policy.

3. 03

   Verify simple credentials are never sent without protected transport.

4. 04

   Compare read and modify rights across designated roles without accessing unrelated entries.

ASSET / ENDPOINT:
SCOPE REFERENCE:
IDENTITY / NETWORK ZONE:
BASELINE:
CONTROL TESTED:
EXPECTED RESULT:
OBSERVED RESULT:
TIMESTAMP / REQUEST ID:
SANITIZED EVIDENCE:
STOP / CLEANUP STATUS:

• Log bind failures, privileged searches, bulk enumeration, ACL changes, and replication changes.
• Alert on cleartext binds and access from new clients.
• Minimize directory attributes retained in assessment evidence.

Keep raw data only when it is necessary to reproduce the finding. Redact credentials, session values, customer content, internal addresses, and personal data before evidence enters a ticket or report.

• Require protected transport and modern authentication.
• Restrict anonymous access and search bases.
• Reduce service-account privileges and rotate credentials.
• Review directory ACL inheritance and monitor sensitive objects.