Lion Cipher Lab
Exploit and fix XPath injection in your lab (bypass a login, then steal a secret one character at a time)
- AppSec / DevSecOps
- Advanced
- ~90 min
- Free · no account required
Why it matters
Any app that lets a user's input steer an XPath query over an XML document — SOAP services, config-driven auth, XML data stores, some SAML and legacy enterprise stacks — can be broken exactly like a SQL-injectable login. It is the same bug class as SQL and LDAP injection: untrusted text is pasted into a query language instead of being passed as data. XPath makes it especially nasty because the whole document is reachable from one injectable filter — there is no GRANT to limit you and no separate 'schema' to hide behind, so a single boolean oracle can walk out every node in the file. This lab…
What you'll learn
- XPath injection (CWE-643)
- authentication-bypass exploitation
- blind boolean data extraction
- XPath variable binding / parameterization
- input validation and least-privilege query design
Steps in this lab
- What XPath injection is, in one breath
- When you'd actually hit this — and when you would not
- Build the throwaway target (offline, 2 minutes)
- Write the vulnerable login (the bug, exactly as it ships in the wild)
- Attack 1 — bypass the login with a tautology
- Attack 2 — steal a secret you can't see, one character at a time (blind boolean)
- The fix that actually works — parameterize, don't sanitize
- Defense in depth — the layers a pro adds around the fix