Bug Bounty, Cybersecurity, Technology, Penetration Testing, Bug Bounty Tips.
by using the following LDAP filter: (&(objectClass=group)(cn=<group_name>)(member=<user_dn>)) An attacker can inject the following payload into the group_name field to bypass the group membership check: *)(objectClass=*)( The modified LDAP filter becomes: