Testing for XPath Injection (OTG-INPVAL-010) - Revision history

Asterix: Corrected link to reference [1] Previous link was outdated.

2015-01-21T16:05:56Z

Corrected link to reference [1] Previous link was outdated.

Andrew Muller: Andrew Muller moved page Testing for XPath Injection (OTG-INPVAL-011) to Testing for XPath Injection (OTG-INPVAL-010)

2014-08-08T12:04:03Z

Andrew Muller moved page Testing for XPath Injection (OTG-INPVAL-011) to Testing for XPath Injection (OTG-INPVAL-010)

Andrew Muller at 16:15, 31 July 2014

2014-07-31T16:15:40Z

Andrew Muller: Andrew Muller moved page Testing for XPath Injection (OWASP-DV-010) to Testing for XPath Injection (OTG-INPVAL-011): Align with Common Numbering

2014-07-31T14:35:49Z

Andrew Muller moved page Testing for XPath Injection (OWASP-DV-010) to Testing for XPath Injection (OTG-INPVAL-011): Align with Common Numbering

Jane O'Connor: Final edit

2014-05-19T10:10:04Z

Final edit

Irene Abezgauz: slight change to summary

2014-04-22T21:50:45Z

slight change to summary

Shady: References

2013-05-12T12:45:34Z

References

Mmeucci at 14:52, 9 October 2012

2012-10-09T14:52:22Z

MediaWiki spam cleanup: Reverting to last version not containing links to www.textracaczelvarr.com

2009-05-27T18:29:54Z

Reverting to last version not containing links to www.textracaczelvarr.com

Deleted user at 17:57, 22 May 2009

2009-05-22T17:57:13Z

@@ Line 67: / Line 67: @@
 == References ==
 '''Whitepapers'''<br>
-* [1] Amit Klein: "Blind XPath Injection" - http://www.modsecurity.org/archive/amit/blind-xpath-injection.pdf
+* [1] Amit Klein: "Blind XPath Injection" - http://dl.packetstormsecurity.net/papers/bypass/Blind_XPath_Injection_20040518.pdf
 * [2] XPath 1.0 specifications - http://www.w3.org/TR/xpath
 <br>

@@ Line 1: / Line 1: @@
 {{Template:OWASP Testing Guide v4}}
-== Brief Summary ==
+== Summary ==
 XPath is a language that has been designed and developed primarily to address parts of an XML document. In XPath injection testing, we test if it is possible to inject XPath syntax into a request interpreted by the application, allowing an attacker to execute user-controlled XPath queries. When successfully exploited, this vulnerability may allow an attacker to bypass authentication mechanisms or access information without proper authorization.
 Web applications heavily use databases to store and access the data they need for their operations. Historically, relational databases have been by far the most common technology for data storage, but, in the last years, we are witnessing an increasing popularity for databases that organize data using the XML language. Just like relational databases are accessed via SQL language, XML databases use XPath as their standard query language.
@@ Line 12: / Line 11: @@
-== Black Box testing and example ==
+== How to Test ==
 The XPath attack pattern was first published by Amit Klein [1] and is very similar to the usual SQL Injection. In order to get a first grasp of the problem, let's imagine a login page that manages the authentication to an application in which the user must enter his/her username and password. Let's assume that our database is represented by the following XML file:

@@ Line 4: / Line 4: @@
 XPath is a language that has been designed and developed primarily to address parts of an XML document. In XPath injection testing, we test if it is possible to inject XPath syntax into a request interpreted by the application, allowing an attacker to execute user-controlled XPath queries. When successfully exploited, this vulnerability may allow an attacker to bypass authentication mechanisms or access information without proper authorization.
-== Short Description of the Issue ==
-Web applications heavily use databases to store and access the data they need for their operations. Historically, relational databases have been by far the most common technology for data storage, but, in the last years, we are witnessing an increasing popularity for databases that organize data using the XML language. Just like relational databases are accessed via SQL language, XML databases use XPath as their standard query language. Since, from a conceptual point of view, XPath is very similar to SQL in its purpose and applications, an interesting result is that XPath injection attacks follow the same logic as [[SQL Injection]] attacks. In some aspects, XPath is even more powerful than standard SQL, as its whole power is already present in its specifications, whereas a large number of the techniques that can be used in a SQL Injection attack depend on the characteristics of the SQL dialect used by the target database. This means that XPath injection attacks can be much more adaptable and ubiquitous. Another advantage of an XPath injection attack is that, unlike SQL, no ACLs are enforced, as our query can access every part of the XML document.<br>
+== Description of the Issue ==
 == Black Box testing and example ==
 The XPath attack pattern was first published by Amit Klein [1] and is very similar to the usual SQL Injection. In order to get a first grasp of the problem, let's imagine a login page that manages the authentication to an application in which the user must enter his/her username and password. Let's assume that our database is represented by the following XML file:
 <pre>
 <?xml version="1.0" encoding="ISO-8859-1"?>
@@ Line 29: / Line 35: @@
 </users>
 </pre>
 An XPath query that returns the account whose username is "gandalf" and the password is "!c3" would be the following:
 <pre>
 string(//user[username/text()='gandalf' and password/text()='!c3']/account/text())
 </pre>
 If the application does not properly filter user input, the tester will be able to inject XPath code and interfere with the query result. For instance, the tester could input the following values:
 <pre>
 Username: ' or '1' = '1
 Password: ' or '1' = '1
 </pre>
 Looks quite familiar, doesn't it?
 Using these parameters, the query becomes:
 <pre>
 string(//user[username/text()='' or '1' = '1' and password/text()='' or '1' = '1']/account/text())
 </pre>
 And as in a common SQL Injection attack, with XPath injection, the first step is to insert a single quote (') in the field to be tested, introducing a syntax error in the query, and to check whether the application returns an error message.
 If there is no knowledge about the XML data internal details and if the application does not provide useful error messages that help us reconstruct its internal logic, it is possible to perform a [[Blind XPath Injection]] attack, whose goal is to reconstruct the whole data structure. The technique is similar to inference based SQL Injection, as the approach is to inject code that creates a query that returns one bit of information. [[Blind XPath Injection]] is explained in more detail by Amit Klein in the referenced paper.
 <br>
 == References ==

@@ Line 2: / Line 2: @@
 == Brief Summary ==
-XPath is a language that has been designed and developed primarily to address parts of an XML document. In [[XPATH Injection|XPath injection]] testing, we test if it is possible to inject data into an application so that it executes user-controlled XPath queries. When successfully exploited, this vulnerability may allow an attacker to bypass authentication mechanisms or access information without proper authorization.<br>
+XPath is a language that has been designed and developed primarily to address parts of an XML document. In XPath injection testing, we test if it is possible to inject XPath syntax into a request interpreted by the application, allowing an attacker to execute user-controlled XPath queries. When successfully exploited, this vulnerability may allow an attacker to bypass authentication mechanisms or access information without proper authorization.
 == Short Description of the Issue ==

@@ Line 52: / Line 52: @@
 == References ==
 '''Whitepapers'''<br>
-* [1] Amit Klein: "Blind XPath Injection" - https://www.watchfire.com/securearea/whitepapers.aspx?id=9
+* [1] Amit Klein: "Blind XPath Injection" - http://www.modsecurity.org/archive/amit/blind-xpath-injection.pdf
 * [2] XPath 1.0 specifications - http://www.w3.org/TR/xpath
 <br>

← Older revision	Revision as of 12:04, 8 August 2014
(No difference)

← Older revision	Revision as of 14:35, 31 July 2014
(No difference)

← Older revision		Revision as of 14:52, 9 October 2012
Line 1:		Line 1:
−	{{Template:OWASP Testing Guide v3}}	+	{{Template:OWASP Testing Guide v4}}

	== Brief Summary ==		== Brief Summary ==

← Older revision		Revision as of 18:29, 27 May 2009
Line 1:		Line 1:
−	~~http://www.textracaczelvarr.com~~
	{{Template:OWASP Testing Guide v3}}		{{Template:OWASP Testing Guide v3}}

← Older revision		Revision as of 17:57, 22 May 2009
Line 1:		Line 1:
		+	http://www.textracaczelvarr.com
	{{Template:OWASP Testing Guide v3}}		{{Template:OWASP Testing Guide v3}}