xpath injection of bWAPP

table of Contents

The xpath injection of bWAPP is as follows, let us log in here

Entering a single quotation mark for the user name found that a parsing error of xami was reported. It can be seen that the user login information parsed by xml/xpath was used.

Here we do not worry about logging in, first look at the source code to learn about this vulnerability

1. Source code analysis

The key code is as follows:

1. The program received the username and password from the front desk without any filtering

2. Then load a local xml file

3. Use xpath language to find the user name and password from the loaded xml file, if found, log in

-"After an analysis, we know the location of the vulnerability. The program does not filter when receiving data for xpath query. For this point, we can construct a bypass and log in directly.

if(isset($_REQUEST["login"]) & isset($_REQUEST["password"]))
{

    $login = $_REQUEST["login"]; 
    $login = xmli($login);    //接收登录的用户名

    $password = $_REQUEST["password"];
    $password = xmli($password);  //接收登录的密码

    // Loads the XML file
    $xml = simplexml_load_file("passwords/heroes.xml"); //加载xml数据

    // XPath search
    $result = $xml->xpath("/heroes/hero[login='" . $login . "' and password='" . $password . "']");   //用xpath查询内容
    if($result)
    {
    ...
    }
}

2. Construction bypass

Bypass login without knowing the username and password. Take out the query code first,

$result = $xml->xpath("/heroes/hero[login='" . $login . "' and password='" . $password . "']");

Actually that's it

$result = $xml->xpath("/heroes/hero[login='用户名' and password=' 密码']");

Construct the user name as follows, and enter the password casually

test' or '1' or '

This is the case after inserting the proceed statement

$xml->xpath("/heroes/hero[login=' test' or '1' or ' ' and password=' xxx']");

We need to know that operators have precedence. Generally, the precedence of the equal sign = is greater than and, and the precedence of and is greater than or. That is,'='>'and'>'or'. login='test' is false, password='xx' is false, or '1' is true, or'' is false

So $result is true, bypassing the login