Ready to Start Your Career?

XPath Injection (Part 1)

Multi Thinker's profile image

By: Multi Thinker

July 1, 2015

XPath is used to create queries which allow users to manipulate data inside a XML document. In this tutorial, we'll start with the basics of XPath queries to understand them better. Later on, we'll move onto the injecting part.Below is a little introduction to XPath from the w3school to understand the terminology used in XPath Data Manipulation Language. Just as we need to know what a database is (tables, columns, data, queries, etc.) if we want to learn SQL injection, we need to understand the basic structures of XML to Inject into XPath queriesIn XPath, there are seven kinds of nodes:
  1. element
  2. attribute
  3. text
  4. namespace
  5. processing-instruction
  6. comment
  7. document
XML documents are treated as trees of nodes. The topmost element of the tree is called the root element.Look at the following XML document:
<?xml version="1.0" encoding="UTF-8"?><bookstore> <book> <title lang="en">Harry Potter</title> <author>J K. Rowling</author> <year>2005</year> <price>29.99</price> </book></bookstore>
 Example of nodes in the XML document above:
(root element node)J K. Rowling (element node)lang="en" (attribute node)
Atomic valuesAtomic values are nodes with no children or parentExample of atomic values:
J K. Rowling"en"
ItemsItems are atomic values or nodes.
Relationship of NodesParentEach element and attribute has one parent.In the following example, the book element is the parent of the title, author, year, and price:
<book> <title>Harry Potter</title> <author>J K. Rowling</author> <year>2005</year> <price>29.99</price></book>
 ChildrenElement nodes may have zero, one or more children.In the following example, the title, author, year, and price elements are all children of the book element:
<book> <title>Harry Potter</title> <author>J K. Rowling</author> <year>2005</year> <price>29.99</price></book>
 SiblingsNodes that have the same parent.In the following example, the title, author, year, and price elements are all siblings:
<book> <title>Harry Potter</title> <author>J K. Rowling</author> <year>2005</year> <price>29.99</price></book>
 AncestorsA node's parent, parent's parent, etc.In the following example, the ancestors of the title element are the book element and the bookstore element:
<bookstore><book> <title>Harry Potter</title> <author>J K. Rowling</author> <year>2005</year> <price>29.99</price></book></bookstore>
 DescendantsA node's children, children's children, etc.In the following example. descendants of the bookstore element are the book, title, author, year, and price elements:
<bookstore><book> <title>Harry Potter</title> <author>J K. Rowling</author> <year>2005</year> <price>29.99</price></book></bookstore>

Next: Xpath Injection Part 2

[divider]* Some examples used throughout this 3 part Xpath Injection series are from the w3schools website. *
Schedule Demo
Build your Cybersecurity or IT Career
Accelerate in your role, earn new certifications, and develop cutting-edge skills using the fastest growing catalog in the industry