webPromedium
Lab 334 — DocuNest — XPath Injection in Knowledge Base Search
hackadvisor
Task: Flask knowledge base with XML-backed search; /search?q= is vulnerable to XPath injection, but @visible attribute filtering in both XPath and app code prevents direct display of hidden articles. Solution: Blind boolean-based XPath injection using union query oracle to enumerate XML structure, locate hidden article 19 containing the flag, and extract it character-by-character via substring().
$ ls tags/ techniques/
flaskaccess_control_bypassxmlhoneypot_flagboolean_oracleknowledge_basexpath_injectionblind_xpathunion_xpathcase_sensitive_search
honeypot_flag_identificationblind_boolean_xpath_injectionxpath_union_query_oraclexml_structure_enumeration_via_blind_injectioncharacter_by_character_substring_extractionxpath_count_enumerationxpath_attribute_brute_force
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Sign in with GitHub to continue. No email required.
$sign in$ grep --similar
Similar writeups
- [web][Pro]DocuNest— hackadvisor
- [web][Pro]Lab 328 — DataNest — NoSQL Operator Injection in Authentication— hackadvisor
- [web][Pro]Knowledge Base— miptctf
- [web][Pro]Dosie X (Dossier X)— hackerlab
- [web][Pro]Lab 335 — LeadForge — XPath Injection in XML-Based CRM— hackadvisor