OK, let's cover another XPath injection, so let's navigate to our menu where we can choose our bags
and let's go with the second XML XPath injection that we have available.
Click on that and click on Haak.
So this application has law enforcement, we need to specify username and password.
So let's give it a try, if you remember from the previous video I mentioned that this will be rather
similar to Eskil injection attack.
So let's go in that direction.
Let's, first of all, specify normal username and password, some unspecified test and test.
Click on login.
And nothing really happens, let's go down, it says invalid credentials.
But what would happen if I type test?
Single quote and single quote, click on login.
Hmm, we do get invalid credentials, but up here we will have a warning or an error.
Simple XML element, invalid predicate in this part.
So we do get an error, the way that we can exploit this error is pretty much the same way that we exploit
Eskil injection.
So all we have to do is type test or one equals one with single quotes.
And the same thing for password or one equals one.
Click on login.
And here it is, we logged in as user Neil, while to your secret.
Oh, why didn't I took that black pill?
So we get the username and it's secret.
But there is more to this than just logging in.
As this user, we can try to log in as any user in case this application defines users with an ID.
For example, Neal could be Edesia.
A different user could be either one, another user could be added to and so on and so on.
In case there is a parameter or variable ID that reflects on each user, then we can switch the user
by changing the ID value so we can try something like this test single quote to close off the normal
input.
And with type four, it equals, for example, to.
Remember not to close the single court at the end because it's already getting closed by the application,
let's type the same thing as passwords to test single quote or ID equals to.
Let's go down.
And now we are a different user welcome, Alice, your secret, there's a cure, we can go even more
so ID equals three and let's do the same right here.
We are thornell, and you can see where this goes.
This application allows us to interact with the ID value, therefore allowing us to switch the username
just by selecting test single code or ID equals to.
And then it's the same as that user and we also get their secret.
So this was rather easy to explain in the next lecture.
We're going to take a look at the different type of vulnerability that we haven't encountered before,
which is called X, X, E, C, the next lecture.