implementation of xpath injection attack...

Question

xpath injection is an attack targeting the websites, where xpath queries are built from user supplied data.Here, Attacker can get the entire xml document without the complete knowledge.
How exactly the attack takes place?
How can we implement this attack?

Thank you

Answer 1

see: http://www.ethicalhacker.net/content/view/185/24/

All injection attacks (including html/javascript injection, sql injection, hql injection) pretty much follow the same principles - basically anywhere you are concatenating user input to a command text, you have the potential for an injection attack.

Besides validating the input as mentioned in the above article, another approach (which might be preferred since it safely allows the use of any characters) would be to encode any user input before using it in an xpath.