XPath injection demonstration application

This is an example app that is vulnerable to xpath injection attacks. This is a standalone app for experimenting with xpath injection issues, or you can use it to test the latest version of xcat.

Quickstart

To quickly run the app with Docker:

docker run -p 4567:4567 tomforbes/xcat-app

Then visit http://localhost:4567 to see the site. As a starting point, the search Rogue') and string('1'='1 will give you a boolean XPath injection you can play with.

The vulnerable / endpoint accepts both URL-encoded GET parameters as well as form-encoded POST parameters.

Examples

xcat run http://localhost:4567 query query=Rogue --true-string=Lawyer

xcat shell http://localhost:4567 query query=Rogue --true-string=Lawyer

Using OOB with Docker

When running inside Docker the IP address of your host is different from the external IP address. When using xcat's --oob flag you must determine the host of your local machine relative to your docker container.

On Docker for mac you can use host.docker.internal. On Linux it is more convoluted, see this stack overflow thread for more info

You can also run the container with --net=host, which will mean the container runs inside your hosts network interface and does not have a separate IP.

Building yourself

Requires jdk+

mvn clean compile assembly:single

Run:

Warning: It is highly recommended to use the docker container if you are exposing this to anyone else, as this is insecure by default. Users will be able to read files (including private keys) on the filesystem.

java -jar target/xcat-app-jar-with-dependencies.jar

Hide xpath queries log:

Add -Dorg.slf4j.simpleLogger.defaultLogLevel=warn to the java cmd.