‫So it's quite common for developers to use XML documents in Web applications and XML documents are generally
‫used to store configuration data or to transfer data from a source to a destination.
‫So most of the programming languages are able to edit or create XML documents.
‫But there is a standard query language, for example, documents.
‫Its name is XPath.
‫So XPath stands, for example, path language.
‫XPath uses path like syntax to query XML documents and like Escorial, it will provide specificity for
‫certain attributes to find them and then the patterns to match, so it helps to identify and navigate
‫nodes in an XML document.
‫Now, XPath differs from other database languages as there is no access controls or user authentication.
‫For instance, an attacker can inject XPath statements in some input fields, and if there's no control
‫at the back end, then it is also possible to access the entire XML document.
‫So in this lesson, we're going to cover XPath attack.
‫So open Caleigh and log in to be Web.
‫We are going to do both.
‫So choose the first one from the menu above, it is a login form.
‫Just write something and log in.
‫OK, so we get an error.
‫And now just enter a single quote and then log in.
‫OK, so this is not what we expect then, right?
‫Normally, we're going to see Escorial errors, but an XML error appears on the top of the page.
‫Now, obviously, it's a different and the data transmits over the Eurail.
‫So let's have a look at the code.
‫Open XML, I underscore one dot page be.
‫Now the developer puts their security checks based on the security level.
‫OK, so we're going to look into this function later, but now scroll down.
‫And this is a part of that we're looking for see here on line 75, the developer loads an XML file.
‫Then they check the log in and password in and XPath query online 78.
‫And then based on the results of this query, it shows the message or in valid credentials, error.
‫OK, so exit this.
‫And we can view the external functions file.
‫So scroll to find an example, injection function up, found it, and it replaces characters that can
‫be used in an XPath query with a whitespace character.
‫OK, so exit.
‫Then let's open sublime text.
‫Now, before we go any further, I do want to show you the XPath query execution.
‫OK, so open the tools menu.
‫Install, package control.
‫OK, so it's installed and now click OK.
‫And go to preferences.
‫Click on package control.
‫Then click install package.
‫And now you're going to see sublime packages or extensions.
‫So to execute XPath queries, we're going to need an extension, so type XPath and just click on the
‫first one.
‫And now it will be installed in the background.
‫OK, so now, though, the heroes that XML file.
‫OK, then hit control shift P.
‫Type query and so like the first one.
‫So now let me zoom it in for you.
‫So this extension helps us to execute XPath queries on a document.
‫So, OK, I'm going to paste the query in the code to here.
‫And the code was like that, and it contains code as well.
‫So we just clean them up.
‫So this is the actual XPath query.
‫Logic is almost the same as escarole queries.
‫So the query just means that under the Heroes route element, choose a hero, which has a specific login
‫and password.
‫All right, so now type Neo.
‫And then Trinity.
‫And now look above the first hero element is chosen.
‫So the login mechanism in this form works like that on this XML file.
‫So now we can delete these values.
‫And put in a single quote.
‫It breaks a query.
‫And nothing appears.
‫And I'll type or one equals one or a single quote.
‫Then all the hero elements are chosen.
‫So I'm going to copy this payload.
‫And go back to Firefox.
‫Pasted into this field and log in.
‫And there it goes, it works so.
‫Actually, we can only see what is in the first line or, well, the first element of the result.
‫OK, so now you can see the code and you can prepare your XPath payloads.
‫Well, let me tell you, in a real world test, it's not really like that.
‫After you see the XML error, you need to try more for exploiting open your perspective a little bit.
‫So this was our payload change one or two and go and we get an error.
‫So this means that our payload executes well.
‫So now it's time to pull the data.
‫And we can view the first hero on the list.
‫And then by adding this code, we can view in other.
‫And it's the same user.
‫This time to.
‫Second users, Alice was the third one for.
‫It was the fourth one, Wolverine.
‫It was the fifth one, Johnny six.
‫Seline Seventy-one.
‫OK, and because there is no other user, we get this error.
‫So anyway, I'm going to give you some payload so that you can go further.
‫So to get a number of the root elements right, this one.
‫And we'll get the result.
‫So it means that there is one root element.
‫And because there is only one rule element, the rest will work like that.
‫So to get the number of elements in the file, right, this one.
‫No, it's not one.
‫Yes, it is 43.
‫Then to the number of child elements under the heroes element, right, this one.
‫Sure enough, there are six children under heroes.
‫And again, the length of the name of the current node and root node type, this payload.
‫And the length is not one, is it, six?
‫Yeah, because it is heroes.
‫So now to get the name of the root element, one by one type, this payload.
‫First character is not a.
‫H.
‫Yeah, the first character is Age, now you can follow along the same way to get the other characters.
‫OK, so to get the length of the name of the first child under the root element, type this payload.
‫And no, it is not one.
‫So is it for.
‫It sure is.
‫OK, so now to get the name of the first child under the root element, one by one type this payload.
‫It is not A, is it, H?
‫And yes, it is.
‫All right, so if we follow along this way, we can extract the name of the first child under the root
‫element.
‫OK, so now to get the number of children of the first child under the root element to this payload.
‫Is it more than one child?
‫So is it six?
‫OK, so the first child has six children.
‫So now let's get the length of the name of the first of this six type in this payload.
‫No, it's not one, is it, to?
‫Why, yes, it is.
‫OK, so get the name of them one by one type in this payload.
‫The first character is not a so that's changed.
‫Why?
‫And yeah, I.
‫So I assume we discovered one by one.
‫Then type this to get the length of the text of this child.
‫A length of text is one.
‫OK, so was this text one.
‫And yeah, the text is one.
‫OK, so.
‫I think you get the point right.
‫So step by step, we discover the root element, the elements, as well as the children.
‫So.
‫If it is necessary, you can discover the attributes and the others as well.
‫But then finally, I want to show you that we will be able to pull data from the XML file.
‫So why don't we go ahead and do another example?
‫So from the menu above, choose the second one.
‫It selects movies based on their genre.
‫So you may not see this royal message on the page.
‫I enabled it from the code so that I could show you how XPath finds the values, so don't freak out,
‫but just open the terminal view xml I underscore to dot BHP.
‫Scroll down to below, and here is the XPath query, so it chooses the child element movie from the
‫hero elements, which has a specific genre element.
‫OK, yeah, I know my sentence.
‫It's a little bit long and weird, but.
‫It's really what it is and what it is, is what it is.
‫Anyway, the remaining part prints the output to the screen and a table.
‫So why don't we go back to Sublime?
‫And Pasic query here.
‫Now I'm going to clear the syntax.
‫And this is the actual XPath query.
‫And the movies immediately appear.
‫Now, if I were to clear here from the Eurail, I can see all the movies.
‫OK, so go to sublime again.
‫Now, add a single quote here.
‫And.
‫Nothing appears.
‫Because it breaks the syntax.
‫So now I'm going to add this.
‫OK, so I think there is no syntax error now, and we'll add something here, OK, perfect result appears
‫that's what we're looking for.
‫So now I'm going to copy this payload and paste it into the You are El.
‫And it works.
‫OK, so let's go back to Sublime and I'm going to add a few things.
‫And this time it will bring all the data into the XML file.
‫So I'll copy this payload and paste it in the you are well and then go.
‫And what do you see?
‫We can view all that text data in the table.
‫All right, so that wraps it up, for example, in Jackson or XPath injection.
‫So you can do whatever you want to at this stage.
‫You can go further, try several other payloads, you can see what works, what doesn't work, that,
‫my friends, is up to you.