XPath injection doubt

From: Anne Beckman (anne.beckman_at_gmail.com)
Date: 09/24/05

  • Next message: Thor (Hammer of God): "Re: MSFT Bans insecure hashes - was"Passwords with Lan Manager (LM) under Windows"" 
    Date: Sat, 24 Sep 2005 09:13:37 +0530
To: pen-test@securityfocus.com

    I am learning the XPath injection technique. To bypass authentication,
    we give a string like:

    hi' or 1=1 or 'hey'='hello

    I noticed that the equivalent string in SQL Injection would have been shorter:

    hi' or 1=1--

    I understand that XPath does not have comments, so we cannot use the
    -- technique to comment out the rest of the query. But how does that
    additional OR clause with 'hey'='hello solve the problem too?

    Thank-you,
    Anne

    ------------------------------------------------------------------------------
    Audit your website security with Acunetix Web Vulnerability Scanner:

    Hackers are concentrating their efforts on attacking applications on your
    website. Up to 75% of cyber attacks are launched on shopping carts, forms,
    login pages, dynamic content etc. Firewalls, SSL and locked-down servers are
    futile against web application hacking. Check your website for vulnerabilities
    to SQL injection, Cross site scripting and other web attacks before hackers do!
    Download Trial at:

    http://www.securityfocus.com/sponsor/pen-test_050831
    -------------------------------------------------------------------------------

  • Next message: Thor (Hammer of God): "Re: MSFT Bans insecure hashes - was"Passwords with Lan Manager (LM) under Windows""

    Relevant Pages

    • Re: [fw-wiz] Protocol inspection
      ... for a pre-existing Web Proxy like Apache or Squid. ... (includes a blacklist version that prevents two specific SQl injection attacks, ...
      (Firewall-Wizards)
    • Re: LSADump2 Crashing Systems
      ... Audit your website security with Acunetix Web Vulnerability Scanner: ... to SQL injection, Cross site scripting and other web attacks before hackers do! ...
      (Pen-Test)
    • Re: SQL Smuggling
      ... of SQL Injection that has not received attention till now. ... "This paper will present a new class of attack, called SQL Smuggling. ... Relying on data validation alone will eventually land you in hot water. ... As for attacks against signature validation... ...
      (Bugtraq)
    • RE: XPath injection doubt
      ... As the entire query is likely in with Xpath, unlike sql. ... I am learning the XPath injection technique. ... Up to 75% of cyber attacks are launched on shopping carts, forms, ...
      (Pen-Test)
    • RE: [PHP] SQL security
      ... > Doesn't MySQL automatically protect against attacks like SQL ... SQL injection attacks that attempt to terminate the current query and execute ...
      (php.general)