Web Penetration Testing with Kali Linux - Third Edition

XPath injection

XPath is a query language for selecting nodes from an XML document. The following is the basic XML structure:

<rootNode> 
  <childNode> 
    <element/> 
  </childNode> 
</rootNode> 

An XPath search for element can be represented as follows:

/rootNode/childNode/element 

More complex expressions can be made, for example, an XPath query for a login page may look like the following:

//Employee[UserName/text()='myuser' And Password/text()='mypassword'] 

As with SQL, if the input from the user is taken as is and concatenated to a query string, such input may be interpreted as code instead of data parameters.

For example, let's look at bWapp's XML/XPath Injection (Search) exercise. It shows a drop box, where you can choose a genre and search ...