What is LDAP injection?
LDAP injection is an attack against applications that build directory queries from user input. The Lightweight Directory Access Protocol stores users, groups and attributes, and many applications query it to authenticate people or look them up, for example behind a sign in with your corporate account button. When the application pastes untrusted input straight into an LDAP filter, an attacker can rewrite the logic of that filter.
How the filter gets rewritten
LDAP search filters use a parenthesized syntax with operators that have special meaning, including the asterisk as a wildcard and the pipe and ampersand for OR and AND. An application might build a filter such as (uid=INPUT) to find one account. If the input is not escaped, an attacker supplies filter characters of their own, for example a value containing *)(uid=*, so the filter now matches many accounts or sidesteps the condition the developer intended. Depending on how the result is used, that can bypass a login check or return directory entries the user should not see.
The indicator and the family it belongs to
In a username or search field, the markers are directory-filter characters out of place: parentheses, asterisks and the logical operators where a plain name belongs. LDAP injection is the same root mistake as SQL and command injection, an interpreter receiving attacker input as syntax rather than data, just aimed at a directory service instead of a database or shell.
How to defend against it
The fix is to keep user input from being read as filter syntax. Escape the special characters according to the LDAP filter rules in RFC 4515, so a parenthesis or asterisk a user types is treated as a literal character, not an operator. Use the directory library's parameterized or safe filter-building functions rather than string concatenation, validate input against the format a field should hold, and give the application's bind account only the read scope it needs so a successful injection reaches little.
LDAP injection on the CompTIA Security+ exam
LDAP injection is an application-attack indicator under SY0-801 objective 2.5. The scenario clue is directory-filter syntax, heavy with parentheses and asterisks, appearing in a login or lookup field, especially where authentication runs against a corporate directory. Separate it from SQL injection, whose payload uses query keywords and quotes, and from cross-site scripting, which carries HTML and script. The defense is escaping per the filter rules and safe query construction.