The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

Subverting Application Logic

Consider an application function that retrieves a user’s stored credit card

number based on a username and password. The following XPath query effec-

tively verifies the user-supplied credentials and retrieves the relevant user’s

credit card number:

//address[surname/text()=’Dawes’ and password/text()=’secret’]/ccard/

text()

Chapter 9 

■

Injecting Code

317

70779c09.qxd:WileyRed  9/14/07  3:13 PM  Page 317

---

In this case, an attacker may be able to subvert the application’s query in an

identical way to a SQL injection flaw. For example, supplying a password with

the value

‘ or ‘a’=’a

will result in the following XPath query, which will retrieve the credit card

details of all users:

//address[surname/text()=’Dawes’ and password/text()=’‘ or ‘a’=’a’]/

ccard/text()

N OT E

■■