James is an attacker who wants to attack XYZ Inc. He has performed reconnaissance over all the publicly available resources of the company and identified the official company website http://xyz.com. He scanned all the pages of the company website to find for any potential vulnerabilities to exploit. Finally, in the user account login page of the company's website, he found a user login form which consists of several fields that accepts user inputs like username and password. He also found than any non-validated query that is requested can be directly communicated to the active directory and enable unauthorized users to obtain direct access to the databases. Since James knew an employee named Jason from XYZ Inc., he enters a valid username `jason` and injects `jason)(&))` in the username field. In the password field, James enters `blah` and clicks Submit button. Since the complete URL string entered by James becomes `(&(USER=jason)
(&))(PASS=blah)),` only the first filter is processed by the Microsoft Active Directory, that is, the query `(&(USER=jason)(&))` is processed. Since this query always stands true, James successfully logs into the user account without a valid password of Jason.
In the above scenario, identify the type of attack performed by James?
ttsang529
2 years, 8 months ago