FilesExpand file tree

main

/

LDAP3_Injection_bad.py

Copy path

Blame

More file actions

Blame

More file actions

Latest commit

 

History

History

History

41 lines (29 loc) · 1009 Bytes

main

/

LDAP3_Injection_bad.py

Copy path

Top

File metadata and controls

• Code
• Blame

41 lines (29 loc) · 1009 Bytes

Raw

Copy raw file

Download raw file

Open symbols panel

Edit and raw actions

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

from flask import request, Flask

import ldap3

app = Flask(__name__)

@app.route("/normal")

def normal():

"""

A RemoteFlowSource is used directly as DN and search filter

"""

unsafe_dc = request.args['dc']

unsafe_filter = request.args['username']

dn = "dc={}".format(unsafe_dc)

search_filter = "(user={})".format(unsafe_filter)

srv = ldap3.Server('ldap://127.0.0.1')

conn = ldap3.Connection(srv, user=dn, auto_bind=True)

conn.search(dn, search_filter)

@app.route("/direct")

def direct():

"""

A RemoteFlowSource is used directly as DN and search filter using a oneline call to .search

"""

unsafe_dc = request.args['dc']

unsafe_filter = request.args['username']

dn = "dc={}".format(unsafe_dc)

search_filter = "(user={})".format(unsafe_filter)

srv = ldap3.Server('ldap://127.0.0.1')

conn = ldap3.Connection(srv, user=dn, auto_bind=True).search(

dn, search_filter)

# if __name__ == "__main__":

# app.run(debug=True)