[pitboss] phase 06: Track J.4 + Track L.4 — LDAP_INJECTION corpus + LdapTemplate / python-ldap / php-ldap adapters

tests/dynamic_fixtures/ldap_injection/python/benign.py

@@ -0,0 +1,14 @@
+"""Phase 06 (Track J.4) — Python LDAP_INJECTION benign control fixture.
+
+Same shape as `vuln.py` but routes the attacker-controlled `uid`
+through `ldap.dn.escape_filter_chars`, escaping the wildcard /
+paren breakout so the directory keeps returning at most one entry.
+"""
+import ldap
+import ldap.dn
+
+
+def run(uid: str):
+    con = ldap.initialize("ldap://127.0.0.1")
+    filt = "(uid=" + ldap.dn.escape_filter_chars(uid) + ")"
+    return con.search_s("ou=people,dc=nyx,dc=test", ldap.SCOPE_SUBTREE, filt)

tests/dynamic_fixtures/ldap_injection/python/vuln.py

@@ -0,0 +1,14 @@
+"""Phase 06 (Track J.4) — Python LDAP_INJECTION vuln fixture.
+
+The function string-concatenates the attacker-controlled `uid` into the
+LDAP filter passed to `ldap.search_s`; a payload like `alice*)(uid=*`
+breaks out of the host `(uid=…)` clause and matches every directory
+entry.
+"""
+import ldap
+
+
+def run(uid: str):
+    con = ldap.initialize("ldap://127.0.0.1")
+    filt = "(uid=" + uid + ")"
+    return con.search_s("ou=people,dc=nyx,dc=test", ldap.SCOPE_SUBTREE, filt)