Home 0P3N Blog XPath Injection (Part 1)
Ready to Start Your Career?
Create Free Account
By: Multi Thinker
July 1, 2015

XPath Injection (Part 1)

By: Multi Thinker
July 1, 2015
By: Multi Thinker
July 1, 2015
XPath Injection (Part 1) - CybraryXPath is used to create queries which allow users to manipulate data inside a XML document. In this tutorial, we'll start with the basics of XPath queries to understand them better. Later on, we'll move onto the injecting part.Below is a little introduction to XPath from the w3school to understand the terminology used in XPath  Data Manipulation Language. Just as we need to know what a database is (tables, columns, data, queries, etc.) if we want to learn SQL injection, we need to understand the basic structures of XML to Inject into XPath queriesIn XPath, there are seven kinds of nodes:
  1. element
  2. attribute
  3. text
  4. namespace
  5. processing-instruction
  6. comment
  7. document
XML documents are treated as trees of nodes. The topmost element of the tree is called the root element.Look at the following XML document:
<?xml version="1.0" encoding="UTF-8"?><bookstore>  <book>    <title lang="en">Harry Potter</title>    <author>J K. Rowling</author>    <year>2005</year>    <price>29.99</price>  </book></bookstore>
 Example of nodes in the XML document above:
(root element node)J K. Rowling (element node)lang="en" (attribute node)
Atomic valuesAtomic values are nodes with no children or parentExample of atomic values:
J K. Rowling"en"
ItemsItems are atomic values or nodes.
Relationship of NodesParentEach element and attribute has one parent.In the following example, the book element is the parent of the title, author, year, and price:
<book>  <title>Harry Potter</title>  <author>J K. Rowling</author>  <year>2005</year>  <price>29.99</price></book>
 ChildrenElement nodes may have zero, one or more children.In the following example, the title, author, year, and price elements are all children of the book element:
<book>  <title>Harry Potter</title>  <author>J K. Rowling</author>  <year>2005</year>  <price>29.99</price></book>
 SiblingsNodes that have the same parent.In the following example, the title, author, year, and price elements are all siblings:
<book>  <title>Harry Potter</title>  <author>J K. Rowling</author>  <year>2005</year>  <price>29.99</price></book>
 AncestorsA node's parent, parent's parent, etc.In the following example, the ancestors of the title element are the book element and the bookstore element:
<bookstore><book>  <title>Harry Potter</title>  <author>J K. Rowling</author>  <year>2005</year>  <price>29.99</price></book></bookstore>
 DescendantsA node's children, children's children, etc.In the following example. descendants of the bookstore element are the book, title, author, year, and price elements:
<bookstore><book>  <title>Harry Potter</title>  <author>J K. Rowling</author>  <year>2005</year>  <price>29.99</price></book></bookstore>
[divider]

Next: Xpath Injection Part 2

[divider]* Some examples used throughout this 3 part Xpath Injection series are from the w3schools website. *
Request Demo

Build your Cybersecurity or IT Career

Accelerate in your role, earn new certifications, and develop cutting-edge skills using the fastest growing catalog in the industry