So as I said before, XML is a very popular data format.
It's used in just about everything from Web services to documents and more.
And an XML document does not only consist of elements and attributes and data.
You can also define a type definition for a document itself.
So at this point, you can request or include some resources from the system.
Then to interpret this XML data, an application needs an XML parser.
An XML external entity attack or excess E injections.
That's where you're going to find him.
So this attack occurs when XML input containing a reference to an external entity is processed by a
weekly configured XML parser.
So it may just lead to the disclosure of confidential data, denial of service, server side request
forgery, port scanning from the perspective of the machine where the person is located and many other
system impacts.
I mean, this is big, right?
So in this lesson, we are going to cover X, X, E attacks.
So let's open up Cali and log in to be Web.
Then choose XML external entity attacks.
Now, the page display looks like this.
So now to see more, let's view the page source.
OK, so I see the JavaScript code here.
And this code makes an Ajax request to execs to dump BHP and it sends the parameters in an XML file
as the post data.
So before doing anything on the page, go to terminal.
Open xixi one P and scroll down a few lines, and here is the JavaScript file in the page source.
So I think there is nothing problematic here for now.
So let's view the other file.
I guess this page will open doors for us, perhaps even many doors, so online 24, the data in the
post request body is taken by the input rapper.
Then this data is assigned to the body variable.
And there is no check for low level and then naturally the body variable is loaded as an example while.
And yeah, it looks like the rest is update code.
Oh, and by the way, displaying an error is opened up on line 30.
OK, so now for the other levels, yeah, it's a little bit different, so 978, the XML external entities
are disabled.
The line is commented.
But for medium and high level, you can uncommented and the rest is the update code as well.
And we can exit.
OK, so now go to Firefox's.
Enable Foxe proxy.
And now I'm going to arrange the screen for you because I like this view.
OK, so when you click this button, the request on the right is sent.
Now, it's a post request and you can see the XML file below as the post data.
And for this request, the detects Zimmel content.
So you can view the XML tab or is it pretty?
OK, so forward this request and the response contains just a message.
OK, forward.
Send the request to berp again and send it to the repeater tool as well.
Then let it go.
OK, so go to the repeater tab, let me maximize burb here.
And now send this first request to check the connection.
Perfect, so it updates be secret.
And I'm going to change here to be one and send.
And it's reflected the response.
OK, so just write something.
And it reflects that also.
So instead of this extra Malfi are just based in this one.
Now, my payload will define an external entity named XXXI and then it prints its value.
And then Sam.
Perfect.
So this means that we can include external resources to that Zemel OK.
Now I'm going to use this pelote.
And it will bring us the content of the password file.
And let's have a look at that payload carefully.
It uses a file wrapper to point to the password file and it works well.
OK, so now let's use one without this file rapper.
And it works also.
OK, so I'm going to pace this one.
And it uses public instead of system.
And we see the hostname.
So now we can use another rapper to pull resources.
But you can encode the file with his wrapper as well.
So send the request.
And the file is encoded, so copy the encoded part.
Based on the decoder.
Then decode is base64.
And here is the content of the file.
So go to the repeater.
We can also view the code files.
And I will advise you to use this wrapper with encoding when you want to pull code files, because in
a normal pull request, that code can cause an XML execution error.
Don't want that.
OK, so send the request.
And encoded result comes to copy it.
And paste it to the decoder.
Not as hex.
And this is the code file of Portale that BHP.
And we can change the file.
And send.
Copy the encode data.
Pasted to the decoder.
And you can have a look at the content of the first tab file.
So paste this payload.
This payload will cause it denial of service.
So in the SML engine tries to load this file, the payload will be expanded into the memory and it will
fill up the entire memory of the server.
So that's how the denial of service will happen.
OK, so then send.
And you see that nothing appears on the response being.
So now try to go to be rap or refresh the page.
And you cannot accomplish to view the page so the server is not configured to prevent such an attack,
it can cause some pretty serious problems.
Thankfully, the Web server and beatboxes configured properly.
And we will get an hour after 30 seconds.
Far out.