XPath Injection Research Articles

A Black-Box Approach to Detect Vulnerabilities in Web Services Using Penetration Testing

Web services work over dynamic connections among distributed systems. This technology was specifically designed to easily pass SOAP message through firewalls using open ports. These benefits involve a number of security challenges, such as Injection Attacks, phishing, Denial-of-Services (DoS) attacks, and so on. The difficulty to detect vulnerabilities,before they are exploited, encourages developers to use security testing like penetration testing to reduce the potential attacks. Given a black-box approach, this research use the penetration testing to emulate a series of attacks, such as Cross-site Scripting (XSS), Fuzzing Scan, Invalid Types, Malformed XML, SQL Injection, XPath Injection and XML Bomb. In this way, was used the soapUI vulnerability scanner in order to emulate these attacks and insert malicious scripts in the requests of the web services tested. Furthermore, was developed a set of rules to analyze the responses in order to reduce false positives and negatives. The results suggest that 97.1% of web services have at least one vulnerability of these attacks. We also determined a ranking of these attacks against web services.

Attacks on Web Services Need to Secure XML on Web

Web Services are the newest mechanism of communication among applications. Web Services are independent of both hardware and software infrastructure, they are very flexible and scalable. Lack of security features provided by the web services creates a window of opportunity for attackers. Web Services are offered on Http with Simple Object Access Protocol (SOAP) as an underlying infrastructure. Both SOAP and Web Services relies heavily on XML, hence, Web Services are most vulnerable to attacks using XML as an attack parameter. Several attacks use XML and most of them lies in the category of XML injection.XML based attacks discussed in this study covered a variety of attacks for example Denial of Services and Data Theft, escalation of privileges etc. Among these attacks the injections attacks on the web services are more severe and being given special attention. This study is aimed at providing an insight of the various forms of XML injections such as XPath injection, Coercive Parsing, and oversize payload.

Protecting Web Services Against XPath Injection Attacks Using SVM Tree Kernel

In recent years, the injection attacks are the most common application layer attacks currently being used on the Internet. The growing acceptance of XML technologies for documents and protocols make the web application uncovered and exploited by hackers. XPath is a language used for querying XML document. XPath Injection attacks occur when a web site uses user-supplied information to construct an XPath query for XML data. In this paper, we proposed an SVM learning based approach to protect web services against the XPath injection attacks. We have implemented a kernel based on trees and incorporate it to the libSVM tool. To proceed, we extract all possible sub trees from the xpath parse tree request, then we find the similarity between two structures by summing the similarity of their substructures. The architecture of our proposed solution is compounded of two principals modules: the learning engine and the predictor one. Before a treatment of incoming XPath queries, an Aspect oriented Programming interceptor component is invoked to intercept this query and submit it to the SVM engine predictor.

PXpathV: Preventing XPath Injection Vulnerabilities in Web Applications

Generally, most Web applications use relational databases to store and retrieve information. But, the growing acceptance of XML technologies for documents it is logical that security should be integrated with XML solutions. In a web application,an improper user inputs is a main cause for a wide variety of attacks. XML Path or XPath language is used for querying information from the nodes of an XML document. XPath Injection is an attack technique, much like SQL injection, exists when a malicious u ser can insert arbitrary XPath code into form fields and URL query parameters in order to inject this code directly into the XPath query evaluation engine. Through the crafted input a malicious user would bypass authentication or to access restricted data from the XML data source.Hence, we proposed an approach to detect XPath injection attack in XML databases at runtime. Our approach intercept XPath expression and parse the XQuery expression to find the inputs to be placed in the expression. The identified inputs are used to design an XML file and it would be validated through a schema.