The following SSI tag can allow an attacker to obtain database

connection strings, or other sensitive data contained within a .NET

configuration file.

References

 Server Side Includes (SSI)    NCSA HTTPd

http://hoohoo.ncsa.uiuc.edu/docs/tutorials/includes.html

 Security Tips for Server Configuration    Apache HTTPD

http://httpd.apache.org/docs/misc/security_tips.html#ssi

 Header Based Exploitation: Web Statistical Software Threats   

CGISecurity.com

http://www.cgisecurity.net/papers/header based exploitation.txt

 A practical vulnerability analysis 

http://hexagon.itgo.com/Notadetapa/a_practical_vulnerability_analys.

htm

4.7  XPath Injection

XPath Injection is an attack technique used to exploit web sites that

construct XPath queries from user supplied input.

XPath 1.0 is a language used to refer to parts of an XML document. It

can be used directly by an application to query an XML document, or

41

Copyright 2004, Web Application Security Consortium. All rights reserved.