XML injection
This section will cover two different perspectives on the use of XML in web applications:
- When the application performs searches in an XML file or XML database
- When the user submits XML formatted information to be parsed by the application
XPath injection
XPath is a query language for selecting nodes from an XML document. The following is the basic XML structure:
<rootNode>
<childNode>
<element/>
</childNode>
</rootNode> An XPath search for element can be represented as follows:
/rootNode/childNode/element
More complex expressions can be made, for example, an XPath query for a login page may look like the following:
//Employee[UserName/text()='myuser' And Password/text()='mypassword']
As with SQL, if the input from the user is taken as is and concatenated to a query string, such input may be interpreted as code instead of data parameters.
For example, let's look at bWapp's XML/XPath Injection (Search) exercise. It shows a drop box, where you...
