Which attack targets directory services by manipulating LDAP statements constructed from user input?

• A. HTML Embedding
• B. Server-side Includes
• C. LDAP Directory Services
• D. LDAP Injection

Answer: (D)

LDAP Injection happens when an application builds LDAP search filters using user-supplied data without escaping or proper validation. LDAP uses filters with parentheses and operators like AND, OR, and NOT, so if input is plugged directly into the filter, an attacker can alter the query’s logic. This can let them bypass authentication or retrieve more data than intended by injecting additional clauses into the LDAP query. For example, if a login routine creates a filter like (&(objectClass=person)(uid=userInput)), a crafted input can close the existing filter and append a new clause, changing the results the directory returns. This precisely describes manipulating LDAP statements constructed from user input. The other options relate to injecting HTML or server-side directives, or simply refer to the directory service itself, not to altering LDAP queries.