OK, let's discuss a new vulnerability called XML or XPath injection.
And to demonstrate this, I want you to navigate to your bebop application.
Under here, I want to scroll a little bit down and find this right here, as it says, XML, XPath
injection, let's click on this one first, which is search for.
So let's click on that click on HECH and it will load this application right here.
Now this vulnerability is kind of similar to ask you out injection.
The input that we send could be processed and filtered through XPath.
Now, since we don't really have any input right here that we can type in, we can assume that this
button is our input so we can select the movie channel, action, horror and science fiction.
If we go with science fiction and we can search, it will output all the science fiction movies.
OK.
Now, let's try intercepting this request without burps.
Let's go right here.
Let's turn on the intercept and let's click on Search.
So we can see our parameters are getting sense through this link, we get Shanor to be action and action
equals such.
Now, let's try a simple injection.
Let's try to see whether we can get error by specifying a single foot the same way that we did with
our Eskow injection.
So let's type action, single quote.
And let's forward this packet.
Let's go back here.
And we do get some error.
We get warning, simple example.
Element XPath, invalid expression.
Now, there is one thing that this application can do, we can check whether it requires entire name
of genre, which is action, or can it determine which genre it is with just a first few letters from
the name.
For example, if we type asked, we can determine that we want the action genre.
Let's give it a try by intercepting the request once again.
And instead of sending action, let's delete last three letters and just leave it on act.
If we forward this go back, it does actually load the action movies so it can determine that we meant
to search for action movies just by looking at first three letters that we specified from the genre
name.
Now, while to check for this, well, if we still get results like that, this could mean that the
application uses function called containers and that function looks something like this, like we just
nano example.
This is the function that our application could possibly use.
And since we're testing this is a black box, we won't be looking at the source code, but we can assume
that the code to the application could look something like this.
Open square brackets contains.
Open normal brackets, genre, comma, and then, quote, dollar sign and something like Shanor input,
it doesn't have to be called like this, but let's just assume that the application could have a code
that looks something like this.
So if the Janner input is contained in the name, then it will just load that.
So let's also use this campins function ourselves to try to get everything outputted that the application
offers, and to do that we need to craft our payload.
Since we assume that the application could potentially use function like this, we need to escape it
first and we're going to escape it with closing off our brackets first and our single code to our input.
So we start like this.
This is our first two characters, and then we must use this syntax, which is slash and then sign,
then pipe, since we're pumping another command for you slash and against our sign.
And now we use our own contains function, which we can access by opening square brackets and then panes.
Then let's open normal brackets and specify one comma, one inside of the single quotes and the last
single code for not specifying due to the same reasons as in the escrow injection.
It's probably already specified inside of the application at the end of our genau input.
So what we did right here is we pretty much closed off this code in the application by specifying these
three signs, then we added our own complaints function and the leftover signs that we closed off in
the application code are getting added at the end right here.
Therefore, we don't need to type it in twice.
If we copied this code.
And we go and intercept our request once again, we instead of typing action, we can delete this and
specify our code, which is this one right here.
If we forward this, go back to the application.
Here it is, we get all the output right here.
You can see the entire database drop, even though it's not a database, but we do get all of the movies
that are in this application just by exploiting the contents function and the unfiltered input through
this genre tap.
Also in the next video, we're going to check another example of XPath injection that we have up, which
will be really, really similar to Eskil injection.
Thank you for watching and I'll see you in the next lecture.