What Is LDAP?

LDAP is the protocol for querying and modifying directory services — the hierarchical stores holding users, groups, devices and their attributes. It is old, widely implemented, and still central to enterprise identity because Active Directory and its equivalents speak it.

The configuration problems that recur

Unencrypted connections. Plain LDAP transmits queries and frequently credentials in clear text. LDAPS or StartTLS addresses this and is not always enabled, particularly for older applications configured years ago.

Anonymous bind. Where the directory permits unauthenticated queries, anyone who can reach it can enumerate users, groups and organisational structure — which is reconnaissance an attacker would otherwise have to work for.

Over-privileged service accounts. Applications integrating with the directory are frequently given broad read access, or write access they do not need, because narrowing it required effort during deployment.

LDAP injection is a real and overlooked class

Where user input is concatenated into a directory query without proper escaping, an attacker can alter the query's meaning — bypassing authentication, retrieving records they should not see, or enumerating the directory.

It is the same class of flaw as SQL injection and receives far less attention, partly because directory queries appear in authentication code that is assumed to be mature. Applications that build filters by string concatenation are worth reviewing specifically.

Bind accounts are a recurring escalation path

Applications that query the directory authenticate to it with a bind account, and those accounts are frequently over-privileged, given long-lived passwords, and configured in application files that many people can read.

An attacker who obtains a bind credential gains whatever the account can do — often reading the entire directory, sometimes modifying it. Because the credential is legitimate, the activity looks like an application doing its job.

Scoping bind accounts narrowly, rotating their credentials, and logging their queries converts them from a quiet escalation route into an observable one. Where the directory supports it, certificate-based authentication for applications removes the stored password entirely.

What the directory reveals when queried broadly

Directory data is a description of the organisation: who works where, who reports to whom, which accounts are service accounts, what naming conventions are used, which groups confer privilege and who belongs to them.

That is precisely the information required to plan a privilege escalation path or write a convincing pretext for a social engineering call. Attackers enumerate directories early for exactly this reason.

Restricting who can perform broad queries, and alerting on enumeration-shaped activity, addresses a reconnaissance step that otherwise happens invisibly and informs everything that follows.

The thing most worth getting right

Directory queries are also worth logging. Because applications query constantly, the baseline is noisy — and a sudden broad enumeration from an account that normally performs narrow lookups stands out clearly against it once anyone is watching.

Where to start

Check whether anonymous bind is permitted and whether connections are encrypted. Both are quick to determine, both are common findings, and both are usually configuration rather than architecture.

See Active Directory. GuardsArm runs security risk assessments.