Welcome back.
Let's discuss a vulnerability called x x.
Now, first of all, what does he stand for?
It stands for XML entity injection.
It happens once an application takes the user input in XML format and it processes external entities
that are declared inside of it.
If that happens, it could be vulnerable to X, X, E or X implanted injection.
Let's take a look at the example of this vulnerability on our Web application.
So let's go to choose our book scroll a little bit down till a seven and all the way down we have XML
internal entity attacks or in brackets Xixi selected and click on Hack.
This followed this very simple application, there is no user input here.
All we have is this of reset your secret to any bugs.
So this is about let's see what happens once we Crickett.
Hmmm, it appears that nothing really happens, let's try intercepting this request inside of our circle
up here, turn on the intercept and let's click on any box.
We get this request, and if we take a look down here, we have the application processing some inputs
in XML format and remember what that means if it's also processes our external entities that we are
going to inject.
It could be vulnerable to the.
But before we actually get to injecting anything, let's first send this request to the repeater.
Let's go action and send to repeater.
We can turn off the intercept and navigate to the repeater.
If we take a closer look, we're going to notice that this request is sending XML structure with our
user name.
So this is our account on boire publication and with a secret.
So let's try ejecting a simple payload to see whether this is vulnerable to Xixi.
And the payload that we are going to inject will be this one.
I'm just going to tie between payload or to 60 real quick and then we are going to copy it.
So this will be our payload DOCTYPE.
Test, let's call it test, then we open square brackets and we create our own entity like this with
type capital entity, let's call the entity internal that entity and let's name it.
But.
So close off all of the tax and this will be our paillard, so essentially what we're doing right here
is we're creating an entity called internal entity, which will have value of boss and boss, will be
a new user that we're going to try to switch inside of our parent.
Now, how are we going to know whether this works?
Well, if we go to our Burset and we send it this simple request.
In the response to this request, we get this sentence right here, it says This secret has been reset.
If our payload gets processed inside of this request, then here it will say, boss, secret has been
reset.
Let's give it a try.
Let's go and copy our payload.
Let's put it up here right above the XML code that they have, so let's paste it right here.
And this is not the only thing that we must do.
We must also change this part right here, since we want to change the user.
We also want to specify which user we want right here.
And the user that we want is stored in this internal entity.
All we have to do is specified it right here.
To do that, we use this sign and then we specify the name of our entity or in our case, internal Desh
entity and semicolon at the end once we send this bill.
Here it is, we get boss secret has been reset, it's no longer the user beat.
In this payload that we created, this internal entity that has a value of boss is used within the login
structure and it got reflected right here in the response.
This means that everything will load through this entity, the server will process and reflect.
So let's try with even more dangerous Paillot.
Let's try to catch the content of etsi past ability.
We can do that by typing this comment or this payload doctype.
Let's call it pest and open square brackets.
We want to create an entity once again.
And we can call it anything we want, we can call it Xixi if we want, or we can just stick with internal
entity.
This is pretty much your choice, how you're going to call it.
And now we're going to call a parameter called system, make sure to type it in capitals.
The capital system, which will take the value between the double quotes of file column three slashes
and then at Seagate has the ability.
This is the file that we want to get the contents from.
Let's not forget to close off our text like this, and this will be our payload for the Xixi.
We are using this system parameter.
We define it in order to get our external entity to load the file.
In our case, the file that preloading is at sea past the.
If this works correctly, once we loaded, the server should show the content of this file in response
to our request.
Let's copy this.
Go back to our Burset, let's delete this.
Paste our new payload, and since we called it once again internal entity, there is nothing really
to change right here.
We can leave it to be internal entity.
But if you were to call it differently in your payload, make sure you switch the name right here as
well.
Also, let's send this.
And here it is, we get the output of slash at sea slash file on the target system and this is Xixi
vulnerability.
Now that we cover that, we're going to take a look at the different type of vulnerability in the next
lecture, which is called Components with known vulnerabilities.
So there.