Home XPath Labs

XPath Lab 2: Secret Extraction

Extract the admin secret without using username=admin (Medium)

Goal: Return ROOT-CHEESE-VAULT without directly submitting admin as username.

Hints
  • The app asks only for username, but the XPath query is still injectable.
  • Try payloads that make the predicate true for more than one node.
  • If you can alter node selection order, the first secret may leak.
Why this works

XPath predicates decide which XML nodes are returned. Injecting boolean logic into the predicate can broaden matching and expose data from unintended nodes.