3

Hi I'm trying to understand XPATH injection, got a loacl ctf issue and cant seem to understand how it works. So this is the query:

555-555-555=true

After fuzzing parameters I get:

Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code.

        <br><br>

        <b> Exception Details: </b>System.Xml.XPath.XPathException:

'//acctprofile[acctid='555-555-555]'test']' has an invalid token.

So I presume there is and XPATH injection here. concat() function work ok, but doc() gives me:

Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code.

        Exception Details: System.Xml.XPath.XPathException: Namespace Manager or XsltContext needed. This query has a prefix,

variable, or user-defined function.

I'm trying to use doc() oob data exfiltration bcos application doesn't output any data if query is ok, so oob was my first idea. Any suggestion would be welcome. To be precise, how in my current situation can I exploit this bug further?

Thank you.

  • 2
    In both cases you have constructed invalid XPath expressions and the system has rejected them. Perhaps I haven't understood the question. – Michael Kay Oct 14 '16 at 15:54
  • Yeah I know that, but what is the proper way to construct expressions for doc() function usage in this case? – Daniel Oct 15 '16 at 20:19
  • You may be able to extract data through the error message by casting a string as an int. You can with SQL server, not tried with XPath. – paj28 Oct 17 '16 at 8:50
1

Hope this will help:

First of all, if right queries don't show anything you're dealing with a blind XPath injection.

Second, the error you've talked about:

Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code.

    Exception Details: System.Xml.XPath.XPathException: Namespace Manager or XsltContext needed. This query has a prefix, variable, or user-defined function.

May require to add the namespace before the query.

This:

//acctprofile[acctid='555-555-555]'test']

Should be more like this:

//"namespace":acctprofile[acctid='555-555-555]'test']

But this requires for you to know the namespace or to have any variable to insert there.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.