Posts on: Web-Attacks

---

Lightweight Directory Access Protocol (LDAP) is a protocol used to access directory servers such as Active Directory (AD) via queries to retrieve information. Web applications may use LDAP for integration with AD or other directory services for authentication or data retrieval purposes. 2025–2026 context: LDAP injection remains a CWE-90 issue with a steady stream of CVEs because the same mistake repeats: user input concatenated into a search filter without RFC 4515 escaping. What has changed is the exploitation depth — blind extraction now uses binary search and OID-based bitwise ordering rather than character-by-character wildcard guessing, and WAF bypass relies on RFC-compliant hex escaping and OID aliasing rather than encoding tricks.

HTTP verb tampering exploits web servers and frameworks that treat HTTP methods inconsistently — a path that returns 403 on GET might return 200 on POST, PUT, or an obscure WebDAV method. The attack works by sending a request with an unexpected method to bypass authorization checks, security filters, or middleware that was only written for GET and POST. The core problem is that many access-control configurations are method-specific. A rule like <Limit GET POST> require valid-user </Limit> in Apache protects only those two verbs; every other method — HEAD, OPTIONS, PUT, DELETE, PATCH, or an invented verb — reaches the handler without authentication.