ldap-pro

• SKILL.mdcore · 6,918 bytes

## Overview

LDAP (and Active Directory, its most common implementation) is the directory backbone of most enterprises: authentication, group membership, and authorization decisions all flow through it. That centrality makes its security critical — cleartext binds, anonymous access, and injection flaws in LDAP-integrated apps are perennial findings.

This skill covers defensive directory practice: encrypted binds, least-privilege service accounts, LDAP injection defense in applications, and directory hygiene. It does not cover offensive AD techniques.

The directory is the identity backbone — compromise it and every downstream system falls. Yet directory security is chronically underinvested because 'it just works.' The defensive program is unglamorous and high-leverage: encrypt the binds, shrink the privileges, clean the cruft, and watch the change logs like the crown-jewel telemetry they are.

## When to use

- Integrating applications with AD/LDAP for authentication or group lookup.
- Remediating findings: cleartext LDAP, anonymous binds, over-privileged service accounts.
- Hardening domain controllers and directory infrastructure.
- Reviewing application code that builds LDAP queries or filters.