XPATH INJECTION TUTORIAL

<div dir="ltr" style="text-align: left;" trbidi="on"> <h1 class="post-title entry-title" style="background-color: white; border: 0px; color: #454545; font-family: Oswald, arial, serif; font-size: 30px; font-weight: 400; line-height: 1.2; margin: 0px; outline: none medium; padding: 0px 0px 5px; text-transform: uppercase; vertical-align: baseline;"> <br /></h1> <br /><span style="background-color: white; font-family: 'Maven Pro', Arial, sans-serif; font-size: 14px; line-height: 22.399999618530273px;"></span><br /> <div class="post-body entry-content" style="background-color: white; border: 0px; font-family: 'Maven Pro', Arial, sans-serif; font-size: 14px; line-height: 22.399999618530273px; margin: 0px 0px 0.75em; outline: none medium; overflow: hidden; padding: 5px 0px 0px; vertical-align: baseline;"> <div style="border: 0px; clear: both; font-family: inherit; font-size: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; outline: none medium; padding: 10px 0px; vertical-align: baseline;"> <div style="border: 0px; float: right; font-family: inherit; font-size: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; outline: none medium; padding: 0px; vertical-align: baseline; width: 250px;"> <ul class="cbtsharethis" style="border: 0px; float: left; font-family: inherit; font-size: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; list-style: none outside none; margin: 0px; outline: none medium; padding: 0px; vertical-align: baseline;"> <li class="facebook" style="background: none 0px 0px repeat scroll transparent; border: 0px; font-family: inherit; font-size: 16px; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: 22px; list-style: none outside none; margin: 5px 0px 0px; outline: none medium; padding: 0px; vertical-align: baseline;"><br /></li> <li class="stumble" style="background: none 0px 0px repeat scroll transparent; border: 0px; font-family: inherit; font-size: 16px; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: 22px; list-style: none outside none; margin: 5px 0px 0px; outline: none medium; padding: 0px; vertical-align: baseline;"><br /></li> <li class="delicious" style="background: none 0px 0px repeat scroll transparent; border: 0px; font-family: inherit; font-size: 16px; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: 22px; list-style: none outside none; margin: 5px 0px 0px; outline: none medium; padding: 0px; vertical-align: baseline;"><br /></li> <li class="digg" style="background: none 0px 0px repeat scroll transparent; border: 0px; font-family: inherit; font-size: 16px; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: 22px; list-style: none outside none; margin: 5px 0px 0px; outline: none medium; padding: 0px; vertical-align: baseline;"></li> </ul> </div> </div> <div dir="ltr" style="border: 0px; font-family: inherit; font-size: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; outline: none medium; padding: 0px; vertical-align: baseline;" trbidi="on"> <div style="border: 0px; font-family: inherit; font-size: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; outline: none medium; padding: 0px; vertical-align: baseline;"> XPath is a language that has been designed and developed to operate on data that is described with XML. The XPath injection allows an attacker to inject XPath elements in a query that uses this language. Some of the possible goals are to bypass authentication or access information in an unauthorized manner.<br style="outline: none medium;" /><br style="outline: none medium;" />We are gonna learn using simple example. Download code from <a href="http://www.4shared.com/zip/SleYPtv8/xpath.html" style="border: 0px; color: #2a7295; font-family: inherit; font-size: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; outline: none medium; padding: 0px; text-decoration: none; vertical-align: baseline;" target="_blank">here</a> & put it in your local server directory.(Code is created by <a href="https://twitter.com/amolnaik4" style="border: 0px; color: #2a7295; font-family: inherit; font-size: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; outline: none medium; padding: 0px; text-decoration: none; vertical-align: baseline;" target="_blank">Amol Naik </a>)<br style="outline: none medium;" /><br style="outline: none medium;" />Sample XML Document which we gonna use:-<br style="outline: none medium;" /><br style="outline: none medium;" /><Employees> <br style="outline: none medium;" /><!-- Employees Database --> <br style="outline: none medium;" />  <Employee ID="1"> <br style="outline: none medium;" />    <FirstName>Johnny</FirstName> <br style="outline: none medium;" />    <LastName>Bravo</LastName> <br style="outline: none medium;" />    <UserName>jbravo</UserName> <br style="outline: none medium;" />    <Password>test123</Password> <br style="outline: none medium;" />    <Type>Admin</Type> <br style="outline: none medium;" />  </Employee> <br style="outline: none medium;" />  <Employee ID="2"> <br style="outline: none medium;" />    <FirstName>Mark</FirstName> <br style="outline: none medium;" />    <LastName>Brown</LastName> <br style="outline: none medium;" />    <UserName>mbrown</UserName> <br style="outline: none medium;" />    <Password>demopass</Password> <br style="outline: none medium;" />    <Type>User</Type> <br style="outline: none medium;" />  </Employee> <br style="outline: none medium;" />  <Employee ID="3"> <br style="outline: none medium;" />    <FirstName>William</FirstName> <br style="outline: none medium;" />    <LastName>Gates</LastName> <br style="outline: none medium;" />    <UserName>wgates</UserName> <br style="outline: none medium;" />    <Password>MSRocks!</Password> <br style="outline: none medium;" />    <Type>User</Type> <br style="outline: none medium;" />  </Employee> <br style="outline: none medium;" />  <Employee ID="4"> <br style="outline: none medium;" />    <FirstName>Chris</FirstName> <br style="outline: none medium;" />    <LastName>Dawes</LastName> <br style="outline: none medium;" />    <UserName>cdawes</UserName> <br style="outline: none medium;" />    <Password>letmein</Password> <br style="outline: none medium;" />    <Type>User</Type> <br style="outline: none medium;" />  </Employee> <br style="outline: none medium;" /></Employees> <br style="outline: none medium;" /></div> <h3 style="-webkit-box-shadow: rgb(170, 170, 170) 1px 1px 2px; background: rgb(251, 251, 239); border-bottom-color: rgb(1, 223, 1); border-bottom-left-radius: 6px; border-bottom-right-radius: 6px; border-bottom-style: solid; border-top-left-radius: 0px; border-top-right-radius: 0px; border-width: 0px 0px 4px; box-shadow: rgb(170, 170, 170) 1px 1px 2px; color: #333333; font-family: 'Yanone Kaffeesatz', arial, serif; font-size: 20px; font-style: inherit; font-variant: inherit; font-weight: 400; line-height: 1; margin: 6px 3px; outline: none medium; padding: 4px 10px; text-shadow: rgb(170, 170, 170) 1px 1px 1px; text-transform: capitalize; vertical-align: baseline; width: 598.5px;"> Bypass Authentication:-</h3> <div style="border: 0px; font-family: inherit; font-size: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; outline: none medium; padding: 0px; vertical-align: baseline;"> <br style="outline: none medium;" />Browse to the login.php page; here we can see simple login form.</div> <br style="outline: none medium;" /><div class="separator" style="border: 0px; clear: both; font-family: inherit; font-size: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; outline: none medium; padding: 0px; text-align: center; vertical-align: baseline;"> <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhv0MPNSgs36j1hmR5sLTO-YBe5h6FL4un5eXPclXjlfcA5t7OxlFjOCGFj8sE8QEXxehLcC922a9F322ulIyl0Ea_gRTaLarFWJMjHtb9Ihm_Dmb3MxYVose0ab1QEwDmZUcRlrgyapUB0/s1600/login.PNG" imageanchor="1" style="border: 0px; color: #2a7295; font-family: inherit; font-size: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px 1em; outline: none medium; padding: 0px; text-decoration: none; vertical-align: baseline;"><img alt="Bypass Authentication" border="0" height="174" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhv0MPNSgs36j1hmR5sLTO-YBe5h6FL4un5eXPclXjlfcA5t7OxlFjOCGFj8sE8QEXxehLcC922a9F322ulIyl0Ea_gRTaLarFWJMjHtb9Ihm_Dmb3MxYVose0ab1QEwDmZUcRlrgyapUB0/s320/login.PNG" style="border: 0px; font-family: inherit; font-size: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; height: auto; line-height: inherit; margin: 0px; max-width: 100%; outline: none medium; padding: 1px; vertical-align: baseline; width: auto;" title="Bypass Authentication" width="320" /></a></div> <br style="outline: none medium;" />If the application does not properly filter such input, the tester will be able to inject XPath code and interfere with the query result. For instance, the tester could input the following values:<br style="outline: none medium;" /><br style="outline: none medium;" />Username: ' or '1' = '1<br style="outline: none medium;" />Password:  ' or '1' = '1<br style="outline: none medium;" /><br style="outline: none medium;" /><div class="separator" style="border: 0px; clear: both; font-family: inherit; font-size: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; outline: none medium; padding: 0px; text-align: center; vertical-align: baseline;"> <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg6JodSiWDj2vL5cbrJDCVSjY5mahhtIqeWKtQLur3SppPVZz9_me5aJo_mpeS4AhBUD1u4QSg85NxY3UA7K7upE06yJry2sY3uznRN-Qtd8qF97bUsjFyWfc2jfv44WcXLKgKvNj0fvwbf/s1600/Bypass-Login.PNG" imageanchor="1" style="border: 0px; color: #2a7295; font-family: inherit; font-size: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px 1em; outline: none medium; padding: 0px; text-decoration: none; vertical-align: baseline;"><img alt="Bypass Authentication using XPATH injection" border="0" height="164" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg6JodSiWDj2vL5cbrJDCVSjY5mahhtIqeWKtQLur3SppPVZz9_me5aJo_mpeS4AhBUD1u4QSg85NxY3UA7K7upE06yJry2sY3uznRN-Qtd8qF97bUsjFyWfc2jfv44WcXLKgKvNj0fvwbf/s320/Bypass-Login.PNG" style="border: 0px; font-family: inherit; font-size: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; height: auto; line-height: inherit; margin: 0px; max-width: 100%; outline: none medium; padding: 1px; vertical-align: baseline; width: auto;" title="Bypass Authentication using XPATH injection" width="320" /></a></div> <div style="border: 0px; font-family: inherit; font-size: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; outline: none medium; padding: 0px; vertical-align: baseline;"> </div> <a href="https://www.blogger.com/null" name="more" style="border: 0px; color: #2a7295; font-family: inherit; font-size: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; outline: none medium; padding: 0px; vertical-align: baseline;"></a>Looks quite familiar, doesn't it? Using these parameters, the query becomes:<br style="outline: none medium;" /><br style="outline: none medium;" />string(//Employee[uname/text()='' or '1' = '1' and passwd/text()='' or '1' = '1']/account/text())<br style="outline: none medium;" /><br style="outline: none medium;" />As in a common SQL Injection attack, we have created a query that is always evaluated as true, which means that the application will authenticate the user even if a username or a password have not been provided.<br style="outline: none medium;" /><br style="outline: none medium;" /><br style="outline: none medium;" /><h3 style="-webkit-box-shadow: rgb(170, 170, 170) 1px 1px 2px; background: rgb(251, 251, 239); border-bottom-color: rgb(1, 223, 1); border-bottom-left-radius: 6px; border-bottom-right-radius: 6px; border-bottom-style: solid; border-top-left-radius: 0px; border-top-right-radius: 0px; border-width: 0px 0px 4px; box-shadow: rgb(170, 170, 170) 1px 1px 2px; color: #333333; font-family: 'Yanone Kaffeesatz', arial, serif; font-size: 20px; font-style: inherit; font-variant: inherit; font-weight: 400; line-height: 1; margin: 6px 3px; outline: none medium; padding: 4px 10px; text-shadow: rgb(170, 170, 170) 1px 1px 1px; text-transform: capitalize; vertical-align: baseline; width: 598.5px;"> Blind Xpath Injection:-</h3> <div style="border: 0px; font-family: inherit; font-size: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; outline: none medium; padding: 0px; vertical-align: baseline;"> <br style="outline: none medium;" />If there is no knowledge about the XML data internal details and if the application does not provide useful error messages that help us reconstruct its internal logic, it is possible to perform a Blind XPath Injection attack whose goal is to reconstruct the whole data structure.<br style="outline: none medium;" /><br style="outline: none medium;" />Browse to the search.php page. Enter any number, When you provide number it will display FirstName related to their ID.</div> <div style="border: 0px; font-family: inherit; font-size: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; outline: none medium; padding: 0px; vertical-align: baseline;"> <br style="outline: none medium;" /></div> <div class="separator" style="border: 0px; clear: both; font-family: inherit; font-size: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; outline: none medium; padding: 0px; text-align: center; vertical-align: baseline;"> <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhmBDooenEDvsP77CCmkE1ymiltCjdf-FIE4N9ZZgpAdMP8f71WVnI-B1yL7REU7tnz2sSRJa_wUWprAdACmlXKmI3do2KP8STSJBRaTgNLmHUs1Cw659_tgRH4LPHXwrdHTmk836_cvP62/s1600/search-first-name.PNG" imageanchor="1" style="border: 0px; color: #2a7295; font-family: inherit; font-size: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px 1em; outline: none medium; padding: 0px; text-decoration: none; vertical-align: baseline;"><img alt="Blind XPATH Injection" border="0" height="111" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhmBDooenEDvsP77CCmkE1ymiltCjdf-FIE4N9ZZgpAdMP8f71WVnI-B1yL7REU7tnz2sSRJa_wUWprAdACmlXKmI3do2KP8STSJBRaTgNLmHUs1Cw659_tgRH4LPHXwrdHTmk836_cvP62/s320/search-first-name.PNG" style="border: 0px; font-family: inherit; font-size: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; height: auto; line-height: inherit; margin: 0px; max-width: 100%; outline: none medium; padding: 1px; vertical-align: baseline; width: auto;" title="Blind XPATH Injection" width="320" /></a></div> <div style="border: 0px; font-family: inherit; font-size: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; outline: none medium; padding: 0px; vertical-align: baseline;"> Enter ' or '1' = '1 in search , & you will get all FirstName regardless of any ID(Number).</div> <div style="border: 0px; font-family: inherit; font-size: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; outline: none medium; padding: 0px; vertical-align: baseline;"> <br style="outline: none medium;" /></div> <div class="separator" style="border: 0px; clear: both; font-family: inherit; font-size: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; outline: none medium; padding: 0px; text-align: center; vertical-align: baseline;"> <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjuDJofcRW4sXK1yspfa51enVddxe868_G2OTCGTzYW5g7Xhmh8QYWdeQw541Xr_uiR4JcTb4FK49jYhmPN4jD24Lng1G-o-Q_HEKrxYCU0fDUbsCtEjOBQly1KV-F1z2_ONCwZA97AGuit/s1600/Bypass.PNG" imageanchor="1" style="border: 0px; color: #2a7295; font-family: inherit; font-size: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px 1em; outline: none medium; padding: 0px; text-decoration: none; vertical-align: baseline;"><img alt="Blind XPATH Injection" border="0" height="118" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjuDJofcRW4sXK1yspfa51enVddxe868_G2OTCGTzYW5g7Xhmh8QYWdeQw541Xr_uiR4JcTb4FK49jYhmPN4jD24Lng1G-o-Q_HEKrxYCU0fDUbsCtEjOBQly1KV-F1z2_ONCwZA97AGuit/s320/Bypass.PNG" style="border: 0px; font-family: inherit; font-size: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; height: auto; line-height: inherit; margin: 0px; max-width: 100%; outline: none medium; padding: 1px; vertical-align: baseline; width: auto;" title="Blind XPATH Injection" width="320" /></a></div> <div style="border: 0px; font-family: inherit; font-size: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; outline: none medium; padding: 0px; vertical-align: baseline;"> In blind Xpath injection we have to provide special crafted query to application, if query is true we will get result otherwise we will not get any result.Till now We don`t know about any parent or child node of XML document.</div> <h3 style="-webkit-box-shadow: rgb(170, 170, 170) 1px 1px 2px; background: rgb(251, 251, 239); border-bottom-color: rgb(1, 223, 1); border-bottom-left-radius: 6px; border-bottom-right-radius: 6px; border-bottom-style: solid; border-top-left-radius: 0px; border-top-right-radius: 0px; border-width: 0px 0px 4px; box-shadow: rgb(170, 170, 170) 1px 1px 2px; color: #333333; font-family: 'Yanone Kaffeesatz', arial, serif; font-size: 20px; font-style: inherit; font-variant: inherit; font-weight: 400; line-height: 1; margin: 6px 3px; outline: none medium; padding: 4px 10px; text-shadow: rgb(170, 170, 170) 1px 1px 1px; text-transform: capitalize; vertical-align: baseline; width: 598.5px;"> Guessing Of Parent Node:-</h3> <div style="border: 0px; font-family: inherit; font-size: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; outline: none medium; padding: 0px; vertical-align: baseline;"> <br style="outline: none medium;" />Supply following query to application & observe result.<br style="outline: none medium;" /><br style="outline: none medium;" />' or substring(name(parent::*[position()=1]),1,1)='a<br style="outline: none medium;" /><br style="outline: none medium;" />Nothing append , we don`t get FirstName of users.<span style="border: 0px; font-family: inherit; font-size: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; outline: none medium; padding: 0px; vertical-align: baseline;">It means first letter of parent node is not "a"</span>. Now supply following query<br style="outline: none medium;" /><br style="outline: none medium;" />' or substring(name(parent::*[position()=1]),1,1)='E</div> <div style="border: 0px; font-family: inherit; font-size: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; outline: none medium; padding: 0px; vertical-align: baseline;"> <br style="outline: none medium;" /></div> <div class="separator" style="border: 0px; clear: both; font-family: inherit; font-size: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; outline: none medium; padding: 0px; text-align: center; vertical-align: baseline;"> <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiLWeXgCHl8QhuYVj_AJtGHOeMwxulnN5igbJUVJCWAbaQo-dJiTHSwwa0UpHFOtXWX6dZQ3lsViuis0GcBn4ZzM6kmeasZpamzNtoRPgKqFxeV-Y5-drAPkiPk8BWprfLySapnc-10hVCO/s1600/Blind-xpath.PNG" imageanchor="1" style="border: 0px; color: #2a7295; font-family: inherit; font-size: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px 1em; outline: none medium; padding: 0px; text-decoration: none; vertical-align: baseline;"><img alt="Blind XPATH Injection" border="0" height="119" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiLWeXgCHl8QhuYVj_AJtGHOeMwxulnN5igbJUVJCWAbaQo-dJiTHSwwa0UpHFOtXWX6dZQ3lsViuis0GcBn4ZzM6kmeasZpamzNtoRPgKqFxeV-Y5-drAPkiPk8BWprfLySapnc-10hVCO/s320/Blind-xpath.PNG" style="border: 0px; font-family: inherit; font-size: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; height: auto; line-height: inherit; margin: 0px; max-width: 100%; outline: none medium; padding: 1px; vertical-align: baseline; width: auto;" title="Blind XPATH Injection" width="320" /></a></div> <div style="border: 0px; font-family: inherit; font-size: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; outline: none medium; padding: 0px; vertical-align: baseline;"> You get result , <span style="border: 0px; font-family: inherit; font-size: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; outline: none medium; padding: 0px; vertical-align: baseline;">It means first letter of parent node is "E"</span></div> <div style="border: 0px; font-family: inherit; font-size: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; outline: none medium; padding: 0px; vertical-align: baseline;"> <br style="outline: none medium;" />To guess second letter of parent node supply following query<br style="outline: none medium;" /><br style="outline: none medium;" />' or substring(name(parent::*[position()=1]),2,1)='m<br style="outline: none medium;" /><br style="outline: none medium;" />Following the same procedure, we can extract the full name of the parent node, which was found to be '<span style="border: 0px; font-family: inherit; font-size: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; outline: none medium; padding: 0px; vertical-align: baseline;">Employee</span>'.</div> <div style="border: 0px; font-family: inherit; font-size: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; outline: none medium; padding: 0px; vertical-align: baseline;"> <br style="outline: none medium;" />We can also get child node. Browse to the xpath.php page & enter following query.<br style="outline: none medium;" /><br style="outline: none medium;" />//Employee[position()=3]/child::node()[position()=4]/text()</div> <div style="border: 0px; font-family: inherit; font-size: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; outline: none medium; padding: 0px; vertical-align: baseline;"> <br style="outline: none medium;" /></div> <div class="separator" style="border: 0px; clear: both; font-family: inherit; font-size: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; outline: none medium; padding: 0px; text-align: center; vertical-align: baseline;"> <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg60LF0K8JOrHjmVyu3sAZM6E9ZSRMuzqQjevWCsvjIehOg9z-awcLLB4F81CzoYZtoJIA09xnU7FbvCbFqmKxp6us5YfO5myIteI2sK3yv10cGP_5KwnTkU20acxbWcyOSU4eWSOveiuq2/s1600/Retriev+DATA.PNG" imageanchor="1" style="border: 0px; color: #2a7295; font-family: inherit; font-size: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px 1em; outline: none medium; padding: 0px; text-decoration: none; vertical-align: baseline;"><img alt="get-child-node" border="0" height="112" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg60LF0K8JOrHjmVyu3sAZM6E9ZSRMuzqQjevWCsvjIehOg9z-awcLLB4F81CzoYZtoJIA09xnU7FbvCbFqmKxp6us5YfO5myIteI2sK3yv10cGP_5KwnTkU20acxbWcyOSU4eWSOveiuq2/s320/Retriev+DATA.PNG" style="border: 0px; font-family: inherit; font-size: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; height: auto; line-height: inherit; margin: 0px; max-width: 100%; outline: none medium; padding: 1px; vertical-align: baseline; width: auto;" title="get-child-node" width="320" /></a></div> <div style="border: 0px; font-family: inherit; font-size: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; outline: none medium; padding: 0px; vertical-align: baseline;"> You got output from parent node Employee id 3 & child node whose position is 2.</div> <div style="border: 0px; font-family: inherit; font-size: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; outline: none medium; padding: 0px; vertical-align: baseline;"> <br style="outline: none medium;" />To get whole document put following query.<br style="outline: none medium;" /><br style="outline: none medium;" />//Employee</div> <div style="border: 0px; font-family: inherit; font-size: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; outline: none medium; padding: 0px; vertical-align: baseline;"> <br style="outline: none medium;" /></div> <div class="separator" style="border: 0px; clear: both; font-family: inherit; font-size: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; outline: none medium; padding: 0px; text-align: center; vertical-align: baseline;"> <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjrAQK5pbrl6TL3Bi2pad__nrgh0RHM6oqVVa_MO6-UU-A1G8idSqi4xy5GT3MmjpmQNn4xKZsvS5_QuofCAVObPiNNPvLea0BmfZKUcjvpDmO-bKIVHKF32vo5rAjyvhHQFnCbDYOgvkc8/s1600/GET-DATA.PNG" imageanchor="1" style="border: 0px; color: #2a7295; font-family: inherit; font-size: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px 1em; outline: none medium; padding: 0px; text-decoration: none; vertical-align: baseline;"><img alt="Blind Xpath injection" border="0" height="192" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjrAQK5pbrl6TL3Bi2pad__nrgh0RHM6oqVVa_MO6-UU-A1G8idSqi4xy5GT3MmjpmQNn4xKZsvS5_QuofCAVObPiNNPvLea0BmfZKUcjvpDmO-bKIVHKF32vo5rAjyvhHQFnCbDYOgvkc8/s320/GET-DATA.PNG" style="border: 0px; font-family: inherit; font-size: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; height: auto; line-height: inherit; margin: 0px; max-width: 100%; outline: none medium; padding: 1px; vertical-align: baseline; width: auto;" title="Blind Xpath injection" width="320" /></a></div> <div style="border: 0px; font-family: inherit; font-size: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; outline: none medium; padding: 0px; vertical-align: baseline;"> It`s just concept how to retrieve data from XML document using XPATH injection.XPath contains two useful functions that can help you automate the preceding attack and quickly iterate through all nodes and data in the XML document:</div> <div style="border: 0px; font-family: inherit; font-size: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; outline: none medium; padding: 0px; vertical-align: baseline;"> <br style="outline: none medium;" /></div> <ul style="border: 0px; font-family: inherit; font-size: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; list-style: none outside none; margin: 10px 0px 10px 20px; outline: none medium; padding: 0px; vertical-align: baseline;"> <li style="background: url(https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiL9jY0auceyiNDg68-jq7fJMEGhhEELxGtbKF6KPgSYnguAleEY3HD0J4GdLSdfUKUhYOaVAromAOj1KnHQOhUIlVYkOewkhI8WBeKcHhettx7ewUCcdIshYQ0CbiopVgxkRWO7s4D-UGw/s24/w2b_bloggerbullet.png) 0% 50% no-repeat scroll transparent; border: 0px; font-family: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: 22px; list-style: none outside none; margin: 7px 0px; outline: none medium; padding: 0px 0px 0px 30px; vertical-align: baseline;">count() returns the number of child nodes of a given element, which can be used to determine the range of position() values to iterate over.</li> <li style="background: url(https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiL9jY0auceyiNDg68-jq7fJMEGhhEELxGtbKF6KPgSYnguAleEY3HD0J4GdLSdfUKUhYOaVAromAOj1KnHQOhUIlVYkOewkhI8WBeKcHhettx7ewUCcdIshYQ0CbiopVgxkRWO7s4D-UGw/s24/w2b_bloggerbullet.png) 0% 50% no-repeat scroll transparent; border: 0px; font-family: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: 22px; list-style: none outside none; margin: 7px 0px; outline: none medium; padding: 0px 0px 0px 30px; vertical-align: baseline;"> string-length() returns the length of a supplied string, which can be used to determine the range of substring() values to iterate over.</li> </ul> <div style="border: 0px; font-family: inherit; font-size: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; outline: none medium; padding: 0px; vertical-align: baseline;"> I used recon-ng xpath bruteforcer for xpath injection attack & we will get back end XML file.<br style="outline: none medium;" /><br style="outline: none medium;" /><div class="separator" style="border: 0px; clear: both; font-family: inherit; font-size: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; outline: none medium; padding: 0px; text-align: center; vertical-align: baseline;"> <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEglg-Uw6EThDA7UyGQ3f3LldHvbquXbhQnb4Jdav4haOYCojoMqBnr5_bDqY76SwqzexU0m4XHYo7AUlX_3Sl1WRRXXaol88zvciIfTZFubA411hBErdawdSKV2NYcexZNcx_LRKVY2MaGs/s1600/Screenshot.png" imageanchor="1" style="border: 0px; color: #2a7295; font-family: inherit; font-size: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px 1em; outline: none medium; padding: 0px; text-decoration: none; vertical-align: baseline;"><img alt="xapth-bruteforcer" border="0" height="200" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEglg-Uw6EThDA7UyGQ3f3LldHvbquXbhQnb4Jdav4haOYCojoMqBnr5_bDqY76SwqzexU0m4XHYo7AUlX_3Sl1WRRXXaol88zvciIfTZFubA411hBErdawdSKV2NYcexZNcx_LRKVY2MaGs/s320/Screenshot.png" style="border: 0px; font-family: inherit; font-size: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; height: auto; line-height: inherit; margin: 0px; max-width: 100%; outline: none medium; padding: 1px; vertical-align: baseline; width: auto;" title="xapth-bruteforcer" width="320" /></a></div> <br style="outline: none medium;" />Useful Links & Blind XPATH injection Tools:-<br style="outline: none medium;" /><br style="outline: none medium;" /><a href="https://www.owasp.org/index.php/XPATH_Injection" style="border: 0px; color: #2a7295; font-family: inherit; font-size: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; outline: none medium; padding: 0px; text-decoration: none; vertical-align: baseline;">https://www.owasp.org/index.php/XPATH_Injection</a><br style="outline: none medium;" /><a href="http://www.blogger.com/goog_913170007" style="border: 0px; color: #2a7295; font-family: inherit; font-size: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; outline: none medium; padding: 0px; text-decoration: none; vertical-align: baseline;"><br style="outline: none medium;" /></a><a href="https://www.owasp.org/index.php/Blind_XPath_Injection" style="border: 0px; color: #222222; font-family: inherit; font-size: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; outline: none medium; padding: 0px; vertical-align: baseline;">https://www.owasp.org/index.php/Blind_XPath_Injection</a><br style="outline: none medium;" /><br style="outline: none medium;" />XPATH BLIND EXPLORER:-  <a href="http://code.google.com/p/xpath-blind-explorer/downloads/list" style="border: 0px; color: #2a7295; font-family: inherit; font-size: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; outline: none medium; padding: 0px; text-decoration: none; vertical-align: baseline;">http://code.google.com/p/xpath-blind-explorer/downloads/list</a><br style="outline: none medium;" /><br style="outline: none medium;" />XCAT:-  <a href="https://github.com/orf/xcat" style="border: 0px; color: #2a7295; font-family: inherit; font-size: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; outline: none medium; padding: 0px; text-decoration: none; vertical-align: baseline;">https://github.com/orf/xcat</a></div> </div> </div> </div>

XPATH INJECTION TUTORIAL

XPath is a language that has been designed and developed to operate on data that is described with XML. The XPath injection...

Read more »