So it's quite common for developers to use XML documents in Web applications and XML documents are generally
used to store configuration data or to transfer data from a source to a destination.
So most of the programming languages are able to edit or create XML documents.
But there is a standard query language, for example, documents.
Its name is XPath.
So XPath stands, for example, path language.
XPath uses path like syntax to query XML documents and like Escorial, it will provide specificity for
certain attributes to find them and then the patterns to match, so it helps to identify and navigate
nodes in an XML document.
Now, XPath differs from other database languages as there is no access controls or user authentication.
For instance, an attacker can inject XPath statements in some input fields, and if there's no control
at the back end, then it is also possible to access the entire XML document.
So in this lesson, we're going to cover XPath attack.
So open Caleigh and log in to be Web.
We are going to do both.
So choose the first one from the menu above, it is a login form.
Just write something and log in.
OK, so we get an error.
And now just enter a single quote and then log in.
OK, so this is not what we expect then, right?
Normally, we're going to see Escorial errors, but an XML error appears on the top of the page.
Now, obviously, it's a different and the data transmits over the Eurail.
So let's have a look at the code.
Open XML, I underscore one dot page be.
Now the developer puts their security checks based on the security level.
OK, so we're going to look into this function later, but now scroll down.
And this is a part of that we're looking for see here on line 75, the developer loads an XML file.
Then they check the log in and password in and XPath query online 78.
And then based on the results of this query, it shows the message or in valid credentials, error.
OK, so exit this.
And we can view the external functions file.
So scroll to find an example, injection function up, found it, and it replaces characters that can
be used in an XPath query with a whitespace character.
OK, so exit.
Then let's open sublime text.
Now, before we go any further, I do want to show you the XPath query execution.
OK, so open the tools menu.
Install, package control.
OK, so it's installed and now click OK.
And go to preferences.
Click on package control.
Then click install package.
And now you're going to see sublime packages or extensions.
So to execute XPath queries, we're going to need an extension, so type XPath and just click on the
first one.
And now it will be installed in the background.
OK, so now, though, the heroes that XML file.
OK, then hit control shift P.
Type query and so like the first one.
So now let me zoom it in for you.
So this extension helps us to execute XPath queries on a document.
So, OK, I'm going to paste the query in the code to here.
And the code was like that, and it contains code as well.
So we just clean them up.
So this is the actual XPath query.
Logic is almost the same as escarole queries.
So the query just means that under the Heroes route element, choose a hero, which has a specific login
and password.
All right, so now type Neo.
And then Trinity.
And now look above the first hero element is chosen.
So the login mechanism in this form works like that on this XML file.
So now we can delete these values.
And put in a single quote.
It breaks a query.
And nothing appears.
And I'll type or one equals one or a single quote.
Then all the hero elements are chosen.
So I'm going to copy this payload.
And go back to Firefox.
Pasted into this field and log in.
And there it goes, it works so.
Actually, we can only see what is in the first line or, well, the first element of the result.
OK, so now you can see the code and you can prepare your XPath payloads.
Well, let me tell you, in a real world test, it's not really like that.
After you see the XML error, you need to try more for exploiting open your perspective a little bit.
So this was our payload change one or two and go and we get an error.
So this means that our payload executes well.
So now it's time to pull the data.
And we can view the first hero on the list.
And then by adding this code, we can view in other.
And it's the same user.
This time to.
Second users, Alice was the third one for.
It was the fourth one, Wolverine.
It was the fifth one, Johnny six.
Seline Seventy-one.
OK, and because there is no other user, we get this error.
So anyway, I'm going to give you some payload so that you can go further.
So to get a number of the root elements right, this one.
And we'll get the result.
So it means that there is one root element.
And because there is only one rule element, the rest will work like that.
So to get the number of elements in the file, right, this one.
No, it's not one.
Yes, it is 43.
Then to the number of child elements under the heroes element, right, this one.
Sure enough, there are six children under heroes.
And again, the length of the name of the current node and root node type, this payload.
And the length is not one, is it, six?
Yeah, because it is heroes.
So now to get the name of the root element, one by one type, this payload.
First character is not a.
H.
Yeah, the first character is Age, now you can follow along the same way to get the other characters.
OK, so to get the length of the name of the first child under the root element, type this payload.
And no, it is not one.
So is it for.
It sure is.
OK, so now to get the name of the first child under the root element, one by one type this payload.
It is not A, is it, H?
And yes, it is.
All right, so if we follow along this way, we can extract the name of the first child under the root
element.
OK, so now to get the number of children of the first child under the root element to this payload.
Is it more than one child?
So is it six?
OK, so the first child has six children.
So now let's get the length of the name of the first of this six type in this payload.
No, it's not one, is it, to?
Why, yes, it is.
OK, so get the name of them one by one type in this payload.
The first character is not a so that's changed.
Why?
And yeah, I.
So I assume we discovered one by one.
Then type this to get the length of the text of this child.
A length of text is one.
OK, so was this text one.
And yeah, the text is one.
OK, so.
I think you get the point right.
So step by step, we discover the root element, the elements, as well as the children.
So.
If it is necessary, you can discover the attributes and the others as well.
But then finally, I want to show you that we will be able to pull data from the XML file.
So why don't we go ahead and do another example?
So from the menu above, choose the second one.
It selects movies based on their genre.
So you may not see this royal message on the page.
I enabled it from the code so that I could show you how XPath finds the values, so don't freak out,
but just open the terminal view xml I underscore to dot BHP.
Scroll down to below, and here is the XPath query, so it chooses the child element movie from the
hero elements, which has a specific genre element.
OK, yeah, I know my sentence.
It's a little bit long and weird, but.
It's really what it is and what it is, is what it is.
Anyway, the remaining part prints the output to the screen and a table.
So why don't we go back to Sublime?
And Pasic query here.
Now I'm going to clear the syntax.
And this is the actual XPath query.
And the movies immediately appear.
Now, if I were to clear here from the Eurail, I can see all the movies.
OK, so go to sublime again.
Now, add a single quote here.
And.
Nothing appears.
Because it breaks the syntax.
So now I'm going to add this.
OK, so I think there is no syntax error now, and we'll add something here, OK, perfect result appears
that's what we're looking for.
So now I'm going to copy this payload and paste it into the You are El.
And it works.
OK, so let's go back to Sublime and I'm going to add a few things.
And this time it will bring all the data into the XML file.
So I'll copy this payload and paste it in the you are well and then go.
And what do you see?
We can view all that text data in the table.
All right, so that wraps it up, for example, in Jackson or XPath injection.
So you can do whatever you want to at this stage.
You can go further, try several other payloads, you can see what works, what doesn't work, that,
my friends, is up to you.