Hey, guys, welcome back to another episode on how the heck so over here I have wept good running.
So we're back to a Web application penetration testing series and we could look under a four, which
is on XML external entities.
So let's go ahead and click on it.
So XML external entity is a way where we understand about how XML operates and how it is being passed
into the Web application system for processing.
And what kind of vulnerabilities and results can we obtain as the server process at an XML instructions.
All right, so this leads us to the XML external entity attack.
So XML entity allow us to use text to define what kind of content is going to be passed from an XML
document into the system.
All right.
So there are internal and external as well as parameter entities.
And as you can see here, we have a document type definition, document type definition and we have
the DOCTYPE.
So in this case we have B.L. Ogi around in the beginning with XML version 1.0 and there's other options
that you can input.
All right.
So we can see all these different details.
And of course, it's always being opened up by certain tagging Belloc, followed by closing a block
so very similar to how you look at Hick's HTML as you structure structure to HTML.
And this case it will be for XML.
So what happens?
Right.
As you can see from this XML version, equal one point zero.
So we have a DOCTYPE and we have the entity.
So we have entity gess and we define it as Joe Smith.
All right.
And of course here we have the output, which is the autre nt JS semicolon.
So this will pull out Jospeh Smith as a result and it goes into the parser and from the parser it will
then just return block and alter information.
All right.
So as you can see here.
Right.
So this help us be able to actually create constant be able to put certain information.
And of course, here we have a Java application XML to get data from the client to the server.
So as you can see here once again, right.
It sent into Java XML parser and after, which helps define certain information.
OK, so as a result of that, this is what we call the XML external entity.
So this is the part where we push information into the web application system, order parser and the
parser will actually pull out certain information for us.
All right.
Like system issue commands the rows of users, certain confidential information, certain directories,
listing of directories, files and folders inside a particular part of the server.
So this is the place where we can launch all these different attacks by uploading an XML document or
information XML information into the Web application server and system.
And that will result in returns of all this different kind of instructions and commands.
All right.
So Onomichi.
All right.
So here's an example.
So in this case where we have a normal XML entity, right?
So we have DOCTYPE Orta, we have the Elliman, all right.
And we have the JS Joe Smith.
And of course this is under the altar.
So you get process over here on the loss roll.
So over here we have the external DTD declaration.
All right.
So we can actually do a definition.
So in this case.
All right, we have the email.
So it is a two from subject and body.
So this is, again, an email, not DTD, that is being sent into the system.
And of course, we have to email.
So you get email two from subject and body and you have all this data.
So an email posterized configured to allow external DTD or entities and we can change the XML snippet
of the following.
So as you can see here.
So what we are entering is Jeff's system and we're using file etek possibility.
So this will Listowel and help us enumerate a list of uses inside the system.
So when you do this inside a system, it will rondi instruction for us and we turn under and semicolon
as a list of users.
All right.
So again, this allow us to run certain system commands, instructions or a reverse shell and so many
different options for us to actually launch the attack from an XML.