Author Archives: Abhay

Abhay 7:21 am on November 1, 2019
Tags: Burp, CI, Continuous Integration, OWASP Top 10, Scan, , Security Scan implementation as part of CI   

Security Scan implementation as part of CI – Continuous Integration

Background: There is no need to explain that it has become imperative to implement security scanning as part of CI process.

Tool:  Portswigger’s Burp Suite , Jenkins

One line statement on how it works :  Burp Suite acts as proxy between client and service and scans all request/response to find security vulnerability.

Obviously, the tool is much more powerful than what I stated in above line and provides range of options to handle various use cases.

Steps to integration Burp Scan in CI using Jenkins: 

1. Install Python/Jython plug in “Carbonator” into Burp.  —> When one launches burp with carbonator options, it can scan all traffic automatically, once traffic stops flowing for 30 seconds.

Without carbonator, you need to generate report manually, which is then impossible to integrate in CI.

2.  Use pipeline to launch Burp Scan —> Pipeline should launch two tasks in parallel.

a) First task starts burp scanner on specific port on a slave.

b) Second task launchs automated flow (UI automation) on same flow that uses Burp as proxy

Once task “b”, finishes , Task “a” creates and publishes report.

3. Review report to see if it identified any new issue.

Task “a” :  Command to launch Burp with carbonator:

java -jar c:\burp\burpsuite_pro_1.7.33.jar  --project-file=burp/test.burp  --config-file=burp/projectOption.json --user-config-file=burp/UserOption.json --unpause-spider-and-scanner https kumar.com 443 /

project-file:  Use a non existing file so that the test report is clean and consistent and does not have data from previous reports. The file , if not present, gets created on the fly.




cont-file:  Set up project config file based on your requirement. you can run Burp manually and setup all the required data for you test. Export project config as Json to create this file. 




user-config-file:  Set up User config file based on your requirement. you can run Burp manually and setup all the required data for you test. Export User config as Json to create this file.




unpause-spider-and-scanner  —  This option start spider and scanner automatically when Burp launches.




https:  http or https can be used as protocol to test




kumar.com:  Url scope for testing




443: Port on which the service is running




/  — Starting folder for test scope:




https   kumar.com  443 /   —> This will create https://kumar.com:443/ as in-scope url

https   kumar.com 443 /test   —> This will create https://kumar.com:443/test as in-scope url

Additional information:

carbonator.py can be modified to suite your needs.

This script can typicaly be found @

  /Users//.BurpSuite/bapps/e3a26fff8e1d401dade52f3a8d42d06b/carbonator.py  on Mac

  /Users//.BurpSuite/bapps/e3a26fff8e1d401dade52f3a8d42d06b/carbonator.py on Windows.

Recommended changes: 

1. Change Time out from 30 seconds to 30 minutes   [ Other wise, Automated test should start within 30 seconds of  Burp scanner start ].

2. Out of Scope Url: Default Carbonator options does not provide command line option to include “Out of Scope Url” . Based on knowledge on the service you are testing, you can disable scanning of various urls by modifying  some lines.

Ex: If you want to include three URLs in “Out of Scope” group

Added three lines as we needed to include three URL as out of scope. This was added after below three lines.

#add to scope if not already in there.

if self._callbacks.isInScope(self.url) == 0:

self._callbacks.includeInScope(self.url)

self._callbacks.excludeFromScope(self.exclude1)

self._callbacks.excludeFromScope(self.exclude2)

self._callbacks.excludeFromScope(self.exclude3)




Value for these variables are set below in the same code after line

self.url = URL(self.scheme,self.fqdn,self.port,self.path)

Added lines:
self.exclude1 = URL(self.scheme,self.fqdn,self.port,'/api/logs')
self.exclude2 = URL(self.scheme,self.fqdn,self.port,'/javascripts')
self.exclude3 = URL(self.scheme,self.fqdn,self.port,'/login')

 

Advertisement
Abhay 1:16 pm on October 5, 2019  

Back to troubleshooting

I have come here after a gap of three years. These three years were very busy for me which made it impossible to contribute to the blog.

In these three years, I have picked up on new tools and coding language. I would spend next few weeks to help you troubleshoot on below areas:

a) Front End automation using protractor, node.js, jasmine. This can work on both angular or, non-angular page.

b) Back End automation – Python and Py.test

c) Security scan tool Burp

d) SAML and OIDC integration

e) Testing solution for DLP for email and cloud services

 

 

Abhay 12:12 pm on July 23, 2017  

Aero-planes

Hello, this a blog about aero-planes. I recommend you read this no matter what your knowledge is about the Flying Machines.

 World War II

Changes

The big change in the making of the great Flying Machines happened in WWII. Some changes were that the propellers changed from fan to jet. They also changed from this :

 

to this:

 

and this:

Planes made

Click on the following link to arrive at a wikipedia page to see list of all the planes that were made:

 

 

 

 

Abhay 11:46 am on November 18, 2016  

Issues with Firefox / Gecko driver (Nov 2016)

I use protractor for automation. There have been issues with webdriver 2.x with FF 48.x and up. protractor does not yet support gecko driver.

I did  workaround mentioned here to enable firefox using gecko driver working with protractor.

This worked well but there are still many feature that are not implemented in gecko driver and seems like they are work in progress.

Here are couple that troubled me and their workaround.

Note: I defined a global variable (say BrowserType) that gets populated with the actual browser type using below code. This variable was used by code to decide when to use firefox specific workaround.

return browser.getCapabilities().then(function (cap){
    return  cap.get('browserName');
});

1. action builder:

Ex:

browser.actions().mouseMove(element).perform();

Errors:

POST /session/22243008-f8f8-4b66-b6b4-bd395994f8db/moveto did not match a known command

Suggested solution:

If you are using similar code to view a dropdown, please don’t spend any more time to solve it. It’s not yet implemented. Use javascript to directly click on the element that is supposed to be shown by mouse over.

Example:

browser.executeScript("arguments[0].click();", element);

2. Getting a attribute value from edit box

Ex:

 element.getAttribute('value');

Errors:

NULL value is returned instead of actual value

Suggested solution:

I could not make it work and finally I had to go back to direct javascript executor to solve this.

Example:

 browser.executeScript("return arguments[0].value", element);

If I hit more blocking issues, I’ll come back and update this page.
By the way,  Selenium 3.x beta is available and works well with webdriver. Though it did not work for me with protractor . If selenium 3.x has worked for you , that may be better option to use instead of above combination.

Abhay 1:43 pm on September 17, 2016
Tags: angularJS, Firefox issue with selenium, Fireofx error with protractor, protractor   

Protractor with Firefox using marionette driver

There have been various issues using selenium-standalone driver due to frequent update to Firefox.  It’s great to see marionette driver from Mozilla. It’s well documented at https://developer.mozilla.org/en-US/docs/Mozilla/QA/Marionette  .

In this article, I have covered steps required to use it with protractor. Note that “Protractor” does not yet support Selenium-Standalone 3.x. Additionally, gecko version 0.8 is the max version that works with selenium-standalone jar 2.x

Steps:

  1. Download gecko driver from https://github.com/mozilla/geckodriver/releases/tag/v0.8.0
  2. Instead of using  webdriver-manager start, use below command 
    java -jar /usr/local/lib/node_modules/protractor/node_modules/webdriver-manager/selenium/selenium-server-standalone-2.53.1.jar -Dwebdriver.chrome.driver=/usr/local/lib/node_modules/protractor/node_modules/webdriver-manager/selenium/chromedriver_2.22 -Dwebdriver.gecko.driver=/usr/local/lib/node_modules/protractor/node_modules/webdriver-manager/selenium/geckodriver-0.8.0-OSX

3.  Add below lines in protractor.conf

capabilities: {
    'browserName': 'firefox',
    'marionette': true
  },

 

That’s it.  You are ready to use Marionette

 

 

–> Above solution solves most of the issue with Firefox 47.x 48.x / selenium-server-standalone-2.53.1.jar

–> It solves issues ike:

1- Firefox launches , but does not load the url

2. You get below exception

[22:41:07] E/launcher - Unable to connect to host 127.0.0.1 on port 7055 after 45000 ms. Firefox console output:
-a285-3208198ce6fd}","syncGUID":"qek8BxoYPz7q","location":"app-global","version":"48.0.2","type":"theme","internalName":"classic/1.0","updateURL":null,"updateKey":null,"optionsURL":null,"optionsType":null,"aboutURL":null,"icons":{"32":"icon.png","48":"icon.png"},"iconURL":null,"icon64URL":null,"defaultLocale":{"name":"Default","description":"The default theme.","creator":"Mozilla","homepageURL":null,"contributors":["Mozilla Contributors"]},"visible":true,"active":true,"userDisabled":false,"appDisabled":false,"descriptor":"/Applications/Firefox.app/Contents/Resources/browser/extensions/{972ce4c6-7e08-4474-a285-3208198ce6fd}.xpi","installDate":1473992361000,"updateDate":1473992361000,"applyBackgroundUpdates":1,"skinnable":true,"size":7140,"sourceURI":null,"releaseNotesURI":null,"softDisabled":false,"foreignInstall":false,"hasBinaryComponents":false,"strictCompatibility":true,"locales":[],"targetApplications":[{"id":"{ec8030f7-c20a-464f-9b0e-13a3a9e97384}","minVersion":"48.0.2","maxVersion":"48.0.2"}],"targetPlatforms":[],"seen":true}
1474090822432    addons.xpi    DEBUG    getModTime: Recursive scan of {972ce4c6-7e08-4474-a285-3208198ce6fd}
1474090822433    DeferredSave.extensions.json    DEBUG    Save changes
1474090822433    addons.xpi    DEBUG    Updating database with changes to installed add-ons
1474090822433    addons.xpi-utils    DEBUG    Updating add-on states
1474090822433    addons.xpi-utils    DEBUG    Writing add-ons list
1474090822434    addons.xpi    DEBUG    Registering manifest for /Applications/Firefox.app/Contents/Resources/browser/features/e10srollout@mozilla.org.xpi
1474090822434    addons.xpi    DEBUG    Calling bootstrap method startup on e10srollout@mozilla.org version 1.1
1474090822434    addons.xpi    DEBUG    Registering manifest for /Applications/Firefox.app/Contents/Resources/browser/features/firefox@getpocket.com.xpi
1474090822435    addons.xpi    DEBUG    Calling bootstrap method startup on firefox@getpocket.com version 1.0.4
1474090822435    addons.xpi    DEBUG    Registering manifest for /Applications/Firefox.app/Contents/Resources/browser/features/loop@mozilla.org.xpi
1474090822436    addons.xpi    DEBUG    Calling bootstrap method startup on loop@mozilla.org version 1.4.4
1474090822451    addons.manager    DEBUG    Registering shutdown blocker for XPIProvider
1474090822451    addons.manager    DEBUG    Provider finished startup: XPIProvider
1474090822451    addons.manager    DEBUG    Starting provider: LightweightThemeManager
1474090822451    addons.manager    DEBUG    Registering shutdown blocker for LightweightThemeManager
1474090822452    addons.manager    DEBUG    Provider finished startup: LightweightThemeManager
1474090822452    addons.manager    DEBUG    Starting provider: GMPProvider
1474090822456    addons.manager    DEBUG    Registering shutdown blocker for GMPProvider
1474090822456    addons.manager    DEBUG    Provider finished startup: GMPProvider
1474090822456    addons.manager    DEBUG    Starting provider: PluginProvider
1474090822457    addons.manager    DEBUG    Registering shutdown blocker for PluginProvider
1474090822457    addons.manager    DEBUG    Provider finished startup: PluginProvider
1474090822457    addons.manager    DEBUG    Completed startup sequence
1474090822865    addons.manager    DEBUG    Starting provider: <unnamed-provider>
1474090822865    addons.manager    DEBUG    Registering shutdown blocker for <unnamed-provider>
1474090822865    addons.manager    DEBUG    Provider finished startup: <unnamed-provider>
1474090822867    DeferredSave.extensions.json    DEBUG    Starting write
1474090823067    addons.repository    DEBUG    No addons.json found.
1474090823068    DeferredSave.addons.json    DEBUG    Save changes
1474090823070    DeferredSave.addons.json    DEBUG    Starting timer
1474090823115    addons.manager    DEBUG    Starting provider: PreviousExperimentProvider
1474090823116    addons.manager    DEBUG    Registering shutdown blocker for PreviousExperimentProvider
1474090823116    addons.manager    DEBUG    Provider finished startup: PreviousExperimentProvider
1474090823119    DeferredSave.extensions.json    DEBUG    Write succeeded
1474090823120    addons.xpi-utils    DEBUG    XPI Database saved, setting schema version preference to 17
1474090823125    DeferredSave.addons.json    DEBUG    Starting write
1474090823150    DeferredSave.addons.json    DEBUG    Write succeeded

[22:41:07] E/launcher - WebDriverError: Unable to connect to host 127.0.0.1 on port 7055 after 45000 ms. Firefox console output:
-a285-3208198ce6fd}","syncGUID":"qek8BxoYPz7q","location":"app-global","version":"48.0.2","type":"theme","internalName":"classic/1.0","updateURL":null,"updateKey":null,"optionsURL":null,"optionsType":null,"aboutURL":null,"icons":{"32":"icon.png","48":"icon.png"},"iconURL":null,"icon64URL":null,"defaultLocale":{"name":"Default","description":"The default theme.","creator":"Mozilla","homepageURL":null,"contributors":["Mozilla Contributors"]},"visible":true,"active":true,"userDisabled":false,"appDisabled":false,"descriptor":"/Applications/Firefox.app/Contents/Resources/browser/extensions/{972ce4c6-7e08-4474-a285-3208198ce6fd}.xpi","installDate":1473992361000,"updateDate":1473992361000,"applyBackgroundUpdates":1,"skinnable":true,"size":7140,"sourceURI":null,"releaseNotesURI":null,"softDisabled":false,"foreignInstall":false,"hasBinaryComponents":false,"strictCompatibility":true,"locales":[],"targetApplications":[{"id":"{ec8030f7-c20a-464f-9b0e-13a3a9e97384}","minVersion":"48.0.2","maxVersion":"48.0.2"}],"targetPlatforms":[],"seen":true}
1474090822432    addons.xpi    DEBUG    getModTime: Recursive scan of {972ce4c6-7e08-4474-a285-3208198ce6fd}
1474090822433    DeferredSave.extensions.json    DEBUG    Save changes
1474090822433    addons.xpi    DEBUG    Updating database with changes to installed add-ons
1474090822433    addons.xpi-utils    DEBUG    Updating add-on states
1474090822433    addons.xpi-utils    DEBUG    Writing add-ons list
1474090822434    addons.xpi    DEBUG    Registering manifest for /Applications/Firefox.app/Contents/Resources/browser/features/e10srollout@mozilla.org.xpi
1474090822434    addons.xpi    DEBUG    Calling bootstrap method startup on e10srollout@mozilla.org version 1.1
1474090822434    addons.xpi    DEBUG    Registering manifest for /Applications/Firefox.app/Contents/Resources/browser/features/firefox@getpocket.com.xpi
1474090822435    addons.xpi    DEBUG    Calling bootstrap method startup on firefox@getpocket.com version 1.0.4
1474090822435    addons.xpi    DEBUG    Registering manifest for /Applications/Firefox.app/Contents/Resources/browser/features/loop@mozilla.org.xpi
1474090822436    addons.xpi    DEBUG    Calling bootstrap method startup on loop@mozilla.org version 1.4.4
1474090822451    addons.manager    DEBUG    Registering shutdown blocker for XPIProvider
1474090822451    addons.manager    DEBUG    Provider finished startup: XPIProvider
1474090822451    addons.manager    DEBUG    Starting provider: LightweightThemeManager
1474090822451    addons.manager    DEBUG    Registering shutdown blocker for LightweightThemeManager
1474090822452    addons.manager    DEBUG    Provider finished startup: LightweightThemeManager
1474090822452    addons.manager    DEBUG    Starting provider: GMPProvider
1474090822456    addons.manager    DEBUG    Registering shutdown blocker for GMPProvider
1474090822456    addons.manager    DEBUG    Provider finished startup: GMPProvider
1474090822456    addons.manager    DEBUG    Starting provider: PluginProvider
1474090822457    addons.manager    DEBUG    Registering shutdown blocker for PluginProvider
1474090822457    addons.manager    DEBUG    Provider finished startup: PluginProvider
1474090822457    addons.manager    DEBUG    Completed startup sequence
1474090822865    addons.manager    DEBUG    Starting provider: <unnamed-provider>
1474090822865    addons.manager    DEBUG    Registering shutdown blocker for <unnamed-provider>
1474090822865    addons.manager    DEBUG    Provider finished startup: <unnamed-provider>
1474090822867    DeferredSave.extensions.json    DEBUG    Starting write
1474090823067    addons.repository    DEBUG    No addons.json found.
1474090823068    DeferredSave.addons.json    DEBUG    Save changes
1474090823070    DeferredSave.addons.json    DEBUG    Starting timer
1474090823115    addons.manager    DEBUG    Starting provider: PreviousExperimentProvider
1474090823116    addons.manager    DEBUG    Registering shutdown blocker for PreviousExperimentProvider
1474090823116    addons.manager    DEBUG    Provider finished startup: PreviousExperimentProvider
1474090823119    DeferredSave.extensions.json    DEBUG    Write succeeded
1474090823120    addons.xpi-utils    DEBUG    XPI Database saved, setting schema version preference to 17
1474090823125    DeferredSave.addons.json    DEBUG    Starting write
1474090823150    DeferredSave.addons.json    DEBUG    Write succeeded

    at WebDriverError (/usr/local/lib/node_modules/protractor/node_modules/selenium-webdriver/lib/error.js:27:10)
    at Object.checkLegacyResponse (/usr/local/lib/node_modules/protractor/node_modules/selenium-webdriver/lib/error.js:639:15)
    at parseHttpResponse (/usr/local/lib/node_modules/protractor/node_modules/selenium-webdriver/http/index.js:538:13)
    at /usr/local/lib/node_modules/protractor/node_modules/selenium-webdriver/http/index.js:472:11
    at ManagedPromise.invokeCallback_ (/usr/local/lib/node_modules/protractor/node_modules/selenium-webdriver/lib/promise.js:1379:14)
    at TaskQueue.execute_ (/usr/local/lib/node_modules/protractor/node_modules/selenium-webdriver/lib/promise.js:2913:14)
    at TaskQueue.executeNext_ (/usr/local/lib/node_modules/protractor/node_modules/selenium-webdriver/lib/promise.js:2896:21)
    at /usr/local/lib/node_modules/protractor/node_modules/selenium-webdriver/lib/promise.js:2820:25
    at /usr/local/lib/node_modules/protractor/node_modules/selenium-webdriver/lib/promise.js:639:7
    at process._tickCallback (node.js:368:9)
From: Task: WebDriver.createSession()
    at Function.createSession (/usr/local/lib/node_modules/protractor/node_modules/selenium-webdriver/lib/webdriver.js:329:24)
    at Builder.build (/usr/local/lib/node_modules/protractor/node_modules/selenium-webdriver/builder.js:458:24)
    at Hosted.DriverProvider.getNewDriver (/usr/local/lib/node_modules/protractor/built/driverProviders/driverProvider.js:37:33)
    at Runner.createBrowser (/usr/local/lib/node_modules/protractor/built/runner.js:190:43)
    at /usr/local/lib/node_modules/protractor/built/runner.js:264:30
    at _fulfilled (/usr/local/lib/node_modules/protractor/node_modules/q/q.js:834:54)
    at self.promiseDispatch.done (/usr/local/lib/node_modules/protractor/node_modules/q/q.js:863:30)
    at Promise.promise.promiseDispatch (/usr/local/lib/node_modules/protractor/node_modules/q/q.js:796:13)
    at /usr/local/lib/node_modules/protractor/node_modules/q/q.js:556:49
    at runSingle (/usr/local/lib/node_modules/protractor/node_modules/q/q.js:137:13)
[22:41:07] E/launcher - Process exited with error code 199

 

 

Abhay 9:52 pm on August 9, 2015
Tags: How to create Self Signed Certificate, p12, pfx, Self Signed Certificate, SSL, x509   

How to create a Self Signed Certificate : x509 / P12 : using OpenSSL

Make sure that you have openssl package on your system. You can download it from http://openssl.com/download.html

Execute Below command:

   openssl req -new -x509 -nodes -out certificate.crt -keyout certificate.key

Example:

openssl req -new -x509 -nodes -out certificate.crt -keyout certificate.key

Generating a 1024 bit RSA private key

……………..++++++

……………++++++

writing new private key to ‘server.key’

—–

You are about to be asked to enter information that will be incorporated

into your certificate request.

What you are about to enter is what is called a Distinguished Name or a DN.

There are quite a few fields but you can leave some blank

For some fields there will be a default value,

If you enter ‘.’, the field will be left blank.

—–

Country Name (2 letter code) [AU]:US

State or Province Name (full name) [Some-State]:California

Locality Name (eg, city) []:San Francisco

Organization Name (eg, company) [Internet Widgits Pty Ltd]:TroubleShoot

Organizational Unit Name (eg, section) []:SSL

Common Name (e.g. server FQDN or YOUR name) []:ServerName.DomainName

Email Address []:troubleshoot@wordpress.com

This will generate certificate.crt (certificate file) and certificate.key (key file)

if you want to Create a P12 (Certificate and key in same file) , run below command:

openssl pkcs12 -export -out certificate.p12 -inkey certificate.key -in certificate.crt

Abhay 10:50 pm on May 17, 2015
Tags: , Automatic Client Certificate selection on Chrome Windows, Client Certificate,   

Chrome on Windows : Automatic Client Certificate selection while using Selenium

To avoid the browser prompt for certificate selection (which requires code outside of Selenium like autoIt/Sikuli)

1. Import the certificate to Windows CAPI

a. You can use IE to import the certificate and store it in in “My Certificate” tab.

or, b. You can use below command to import the certificate

“certutil -f -user -p <password>  -importpfx <certificate>”

If you are automating the flow and may want to delete older certificate , You can use bolo code written in Java

String allCerts = execCommand.runCommand(“certutil -store -user My”);

List<String> CN = new ArrayList<String>();

int a = allCerts.indexOf(“, CN=”);

int b = allCerts.lastIndexOf(“, CN=”);

int c = allCerts.indexOf(” Non-root Certificate”);

int l = 0;

while( a <= b && a!=-1){

CN.add(allCerts.substring(a+5,c ));

String delCerts = execCommand.runCommand(“certutil -delstore -user My \”” + CN.get(l) + “\””);

log.info(“Deleting “ + CN.get(l) + ” : “ + delCerts);

l++;

a = allCerts.indexOf(“, CN=”,i+1);

c = allCerts.indexOf(” Non-root Certificate”,c+1);

}}

2. To let Chrome automatically select the certificate automatically:

Edit registry entry:  (If it does not exist, create it )

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome\AutoSelectCertificateForUrls

Add Key: 1

Value: {{“pattern”:”[*.]abhay.com”,”filter”:{“ISSUER”:{“CN”:”ABHAY_ISSUER”}}}}

–> with above content, a certificate issued from CA “ABHAY_ISSUER” will automatically get selected when user access <any>.abhay.com

Abhay 10:27 pm on May 17, 2015
Tags: , Automatic Client Certificate selection in Mac on OSX / Mac,   

Chrome on Mac /OSX: Automatic Client Certificate selection while using Selenium

To avoid the browser prompt for certificate selection (which requires code outside of Selenium like autoIt/Sikuli)

1. Import the certificate to keyChain

Import the client certificate into keychain. Open the certificate detail –> Go to Trust section –> Select  “Always trust” for  “When using this certificate”

You can do this with command line utility as well:

security import   /<certDir>/certificate   -k  + ~/Library/Keychains/login.keychain  + ” -P ” + <password>;

2. To let Chrome automatically select the certificate automatically:

Create or Edit file “/Library/Preferences/com.google.Chrome.plist” :

<plist version=”1.0″>

<dict>

<key>AutoSelectCertificateForUrls</key>

<array>

<string>{“pattern”:”[*.]abhay.com”,”filter”:{“ISSUER”:{“CN”:”ABHAY_ISSUER”}}}</string>

</array>

</dict>

</plist>

–> with above content, a certificate issued from CA “ABHAY_ISSUER” will automatically get selected when user access <any>.abhay.com

Abhay 11:27 am on December 5, 2014
Tags: , Complex LDAP Search, ,   

Basic LDAP Search Filters – 2

LDAP Search Command: ldapsearch -h <LDAPHost> -p <Port> -D <Bind DN> -w <Bind DN password> -b <Base DN> -s <Scope>  <LDAP Search Filter>

Ex: ldapsearch -h 192.168.1.2 -p 389 -D cn=admin,o=novell -w password -b o=novell -s sub cn=brown

Below example are with attribute CN. But, You can use it with any attribute

1. AND condition (&)

  (&(CN=brown)(SN=mike))   ==> returns all the entries which has attribute CN as “brown” (case insensitive search) and SN as “mike”

  (&(cn=brown)(SN=mike)(zipcode=123456))  ==>  returns all the entries which has attribute CN as “brown” (case insensitive search) , SN as “mike” and zip code as “123456”

2. OR condition  (|)

  (|(CN=brown)(SN=mike)) ==> returns all the entries which has attribute CN as “brown”  or,  SN as “mike”

3. Complex – AND and OR

  (&(|(CN=Michael)(CN=mike))(SN=brown))  ==> returns all the entries which has attribute CN as Michael or, Mike and SN as Brown.

4. FDN in search

  to search group membership, you may use below filter:

  Novell eDirectory:

   (&(cn=mike)(groupmembership=”cn=groupofDirectors, ou=groups, o=company))  ==> this will return any entry whose CN is Mike and is member of group ” groupmembership=”cn=groupofDirectors, ou=groups, o=company”

Abhay 1:51 pm on December 4, 2014
Tags: , LDAP Basic Sarch Filter, , LDAP Search Filter,   

Basic LDAP Search Filters

LDAP Search Command: ldapsearch -h <LDAPHost> -p <Port> -D <Bind DN> -w <Bind DN password> -b <Base DN> -s <Scope>  <LDAP Search Filter>

Ex: ldapsearch -h 192.168.1.2 -p 389 -D cn=admin,o=novell -w password -b o=novell -s sub cn=user

Below example are with attribute CN. But, You can use it with any attribute

1. Equal

CN=User  ==> returns all the entries which has attribute CN as “user” (case insensitive search)

2. presence:

CN=*  ==> returns all the enteries which has at least one value for attribute “CN”

3. start with

CN=User*  ==>  Returns all the entries which has at least one value for CN which starts with “User”

Matches:  User , User123 , User-123 , UserRam

Will not match: Use , AuserA , UseA

4. Ends with :

CN=*User  ==>  Returns all the entries which has at least one value for CN which ends with “User”

Matches: User , AUser , KJHksdahaksdjh*aUser , 7678User

Will not match :   User123 , User-123 , UserRam

5. Is not Equal to

(!(CN=User)) ==> Returns all the entries which does not have value for CN as “User”

6. like

CN~=User

6. Greater than

employeeId >= 100 ==> Returns all the entries whose employee ID is greater than 100

7. Less than

employeeId <= 100 ==> Returns all the entries whose employee ID is less than 100