LDAP Security and Directory Services
Xs explores ldap security and directory services at DEF CON 8, examining ldap and practical defenses.
Summary
Architecture and Background
Xs present 'LDAP Security and Directory Services' at DEF CON 8, reviewing foundational threat dynamics and system principles surrounding ldap, directory-services, authentication, network-protocols in the appsec arena.
Vulnerability Analysis
The technical analysis dissects design vulnerabilities, protocol flaws, and architectural assumptions relevant to enterprise networks.
Exploitation and Demonstrations
Xs presents an in-depth exploration of LDAP directory services at DEF CON 8, dissecting the protocol mechanics of Lightweight Directory Access Protocol, security misconfigurations in directory trees, anonymous bind exploits, and credential harvesting methodologies.
Remediation and Defensive Strategies
System defenders and security engineers are provided actionable hardening steps, monitoring indicators, and mitigation guidelines to reduce exposure.
Related talks
Main Stage·37 min
M Casagrande · D Antonioli
Presents CTRAPS, a novel class of API confusion and impersonation attacks targeting the Client to Authenticator Protocol (CTAP) in FIDO2 hardware keys.
Main Stage·34 min
S Pratap Singh · J Lin · D Seetoh
Demonstrates architectural and implementation weaknesses in commercial passkey syncing and WebAuthn relying party implementations.
Main Stage·19 min
Michael Stepankin
Michael Stepankin analyzes implementation flaws in mutual TLS (mTLS) certificate authentication, detailing CVEs in open-source identity servers leading to impersonation.