CVE-2021-29156

This Go-based exploit demonstrates LDAP injection in OpenAM 13.0 via brute-forcing character-by-character to extract password hashes. It uses HTTP requests with crafted payloads to test for valid characters in the hash.

This repository contains a functional Go-based proof-of-concept exploit for CVE-2021-29156, an LDAP injection vulnerability in ForgeRock OpenAM v13.0.0. The exploit performs a character-by-character brute force attack to extract user password hashes via crafted LDAP queries.

This repository contains a functional Go-based exploit for CVE-2021-29156, an LDAP injection vulnerability in OpenAM. The tool performs a brute-force attack to recover user passwords by leveraging a timing-based side-channel in the WebFinger endpoint.