‫So as I said before, XML is a very popular data format.
‫It's used in just about everything, from Web services to documents and more.
‫And an XML document does not only consist of elements and attributes and data.
‫You can also define a type definition for a document itself.
‫So at this point, you can request or include some resources from the system then to interpret this
‫XML data and application needs and XML parser.
‫An XML external entity attack or excess E injections.
‫That's where you're going to find him.
‫So this attack occurs when XML input containing a reference to an external entity is processed by a
‫weekly configured XML parser.
‫So it may just lead to the disclosure of confidential data.
‫Denial of service.
‫Server side request forgery.
‫Port scanning from the perspective of the machine where the person is located and many other system
‫impacts.
‫I mean, this is big, right?
‫So in this lesson, we are going to cover X X E attacks.
‫So let's open up, Carly and log in to B Web.
‫Then choose an XML external entity attacks.
‫Now, the page display looks like this.
‫So now to see more, let's view the page source.
‫OK, so I see the JavaScript code here.
‫This code makes an Ajax request to execs to the HP, and it sends the parameters in an XML file as the
‫post data.
‫So before doing anything on the page, go to terminal.
‫Open exec C one P.
‫And scroll down a few lines.
‫And here is the JavaScript file and the page source.
‫So I think there is nothing problematic here for now.
‫So let's view the other file.
‫I guess this page will open doors for us, perhaps even many doors.
‫So online 24, the data in the post request body is taken by the AP input wrapper.
‫Then this data is assigned to the body variable.
‫And there is no check for a low level, and then naturally, the body variable is loaded as an example
‫file.
‫And yeah, it looks like the rest is update code.
‫And by the way, displaying an error is opened up on line 30.
‫OK, so now for the other levels, yeah, it's a little bit different.
‫So a seventy eight a.m. external entities are disabled.
‫The line is commented.
‫But for medium and high level, you can uncomment it, and the rest is the update code as well.
‫And we can exit, OK, so now go to Firefox.
‫Enable foxy proxy.
‫And now I'm going to arrange this screen for you because I like this for you.
‫OK, so when you click this button, the request on the right is sent.
‫Now, it's a post request, and you can see the XML file below as the post data.
‫And for this request, the tax exempt content.
‫So you can view the XML tab.
‫Oh, is it pretty?
‫OK, so forward, this request and the response contains just a message.
‫OK, forward.
‫Send the request to Burp again and send it to the repeater tool as well.
‫Then let it go.
‫OK, so go to the repeater tab.
‫Let me maximize BRB here.
‫And now send this first request to check the connection.
‫Perfect two it updates be secret.
‫And I'm going to change here to be one and send.
‫And it's reflected the response.
‫OK, so just write something.
‫And it reflects that also.
‫So instead of this simple fire, I'll just paste in this one.
‫Now, my payload will define an external entity named X XY, and then it prints its value.
‫And then send.
‫Perfect, so this means that we can include external resources to that XML.
‫OK.
‫Now I'm going to use this payload.
‫And it will bring us the content of the password file.
‫Now, let's have a look at that payload carefully.
‫It uses a file wrapper to point to the password file, and it works well.
‫OK, so now let's use one without this file wrapper.
‫And it works also.
‫OK, so I'm going to paste this one.
‫And it uses public instead of system.
‫And we see the hostname.
‫So now we can use another BHP wrapper to pull resources.
‫But you can encode the file with his wrapper as well.
‫So send the request.
‫And the file is encoded, so copy the encoded part.
‫Based to the decoder.
‫Then Decode is based 64.
‫And here is the content of the final.
‫So go to the repeater.
‫We can also view the code files.
‫And I will advise you to use this wrapper with encoding when you want to pull the code files.
‫Because in a normal pull request, the code can cause an XML execution error.
‫Don't want that?
‫OK, so send the request.
‫And encoded result comes, so copy it.
‫And paste it to the decoder.
‫Not as hex.
‫And this is the code file of Portal that BHP.
‫And we can change the file.
‫And send.
‫Copy the ENCODE data.
‫Pasted to the decoder.
‫And you can have a look at the content of the fStab tab file.
‫So piece this payload.
‫This payload will cause a denial of service.
‫So when the XML engine tries to load this file, the payload will be expanded into the memory and it
‫will fill up entire memory of the server.
‫So that's how the denial of service will happen.
‫OK, so then send.
‫And you see that nothing appears on the response been.
‫So now try to go to be wrap or refresh the page.
‫And you cannot accomplish is to view the page, so the server is not configured to prevent such an attack,
‫it can cause some pretty serious problems.
‫Well, thankfully, the webserver and B is configured properly.
‫And we will get an error after 30 seconds.
‫Far out.