So in this regard, we are going to talk about this tachycardic some external entity, so this is based
on this XML parsers, so frustrated about this, uh, uh, uh, file format.
So let's first learn about this.
What is summer XML stands for Extensible Markup.
Language is a markup language just like Yamal, but there are already predefined tax manage to end paragraph,
anchor, etc.
But this is a user base.
I mean, you can use the custom tags in place of those, uh, H1, H2, etc..
So why do you want these custom tags.
Uh, you need to use it for storing and transporting data supports.
If you want to send this data you can see here, uh, mail and the CPU, Furkan.
And from this subject about Xixi actually is going to be toward Xixi.
So you're going to see the main has been closer.
You can see this, uh, similar to this.
There is a paragraph in the body and this is the text and the data.
So what this does is they will extract this, uh, this top, uh, element and then they will extract
the next element and then they will accept the data and say this.
So they will form a tree like structure.
I will show you Java XML parser.
So.
So let me show you how the pass.
So one day they will pass regulatory structure.
They will go from the top of the element to the family tree, from the subelements and then into the
subelements.
If there are any supplements, they will from another node and they will finally extract the little.
So this will be the example you can see there is a class and inside the class there are students information.
You can see student at about 3:00 and 4:00 a.m. and MOCs.
So this is used to store the student information and on the other servers are a receiver so that you
can just use this password to get the all the information.
So why this symbol means different Web services runs on different of several languages.
Suppose you may build up a website using the BHP and someone may build up using PAIDA.
So in order to exchange this data, this example is very suitable because it's not programming independent
and you can just it's like markup language.
You can just, uh, use this data and send it to any application and you need one programming language.
There are parts.
So now I'm showing you this XML XML parser.
So don't perceptual, uh, person based on these objects and we can extract the data from this.
So each program does have its XML parcels and then we get the data from all to the Web server so that
Serbo this summer basics.
Now let's go into this.
Uh Xixi at.
So no external entity attack is one of the biggest features of our policies.
So whenever this somebody is going to pass on the data and we will inject a period in this data such
that XML parser on executing the payload will redefine or will be the server you going even performance
here of.
So it's just sort of attack.
So this is the actual sea attack or you.
And there are two types of these Xixi attacks in urban environments that I get to refer to immediately.
Let me respond to that.
Uh, to the victim, to us and open access the attacks.
Uh, we need to output to some other file and we need to use that.
So those are the two types of attacks.
Um, so why do you think someone would have already seen so one important thing I need to mention is
X validation using digital delivery stands for document data definition and this document type definition
defines how XML format should be.
So there is, uh, this is called rudiment and this is called, uh, child element.
And then you can see there are two elements or two from subject text, and this is called data.
And now, as you can see, this is, uh, similar what I have told, so now they're asking some questions.
So let's try to answer those Exemestane then Cebull.
I'm Marco.
Language, so is it compulsory to her and so she's just to a good practice, but it's not mandatory.
Can we read it some documents just so that is going to the schema?
And there are some tools.
You can add the digital schema and then that will be a disclaimer.
So this reminds me of Armi, this dialogue versus when I had my Java course on my college, then it's
very hard to just to extract a small XML document into the data.
So you get all this using the objects.
The objects are determined by acceptable.
So this is in Java.
It's very hard.
I don't know this XML parsing in Python, but I think it's very easy because Python is very easy, readable
and readable then Java.
So can you work some version and coding and XML?
So that's, I think, some version.
So can you switch to someone version and so when you to do the starting axman version is close to one
point zero.
So let me come to this questioning after doing some other tasks.
So let's talk about this DTD document type definition and define the structure and legal elements of
attributes of, for example, document.
So if this is wrong, then our XML parser will just give us an error that, uh, these elements are
not in the character.
So let's take this note of this.
You can see not and in this note there, we have three children.
So reforged elements, two from hurting anybody.
And each child would have some that are very confused taking Xixi.
So as you can see, duct tape, duct tape, which stands for rope, this is the root, not notice the
root null.
And then we have this element not so we are describing what are the subelements, other elements of
this note.
And the third elements of this note are from hitting and we can see two from hitting bottom.
And we need to specify the, uh, what is the whatever that is called in this in between, these two
elements can see 11 to two different pieces that you can see pieces that are here means possible character
that are simply ASCII values.
And two pieces that are from heading and body are defined as pieces that are so unique, so many to
simply strings.
So we have a root note.
And in that note, we are defining, uh, for change elements.
Those consist of are the strings as, uh, that are that are so you can import.
So this has some texture and you can just give it to to to take this example.
So if there is another element to suppose sample, uh, sample, then it will fit because we have to
find only four elements.
But if there is another element, then that producer you can see here, DOCTYPE defines a root and element.
And these are the detailed elements of this group.
So how do you define a new element?
How to define.
Rudiment is using this, adopting.
How will we find new entry?
I think this is element.
Yes, I just confused between this and tenantry, so entity is also like, uh, scoring available.
Now let's see what water Xixi pillories.
Now, let's see carefully here in this data, the special characters are not like quotations, uh,
backwards and forwards, rashes, etc. Those are not allowed know how to implement those special characters
in the data means you need to specify that we will see need to say and name and interface with the fish.
So whenever I use the ampersand name, then that fish value will be placed at the time.
Want the XML parsing it like an external entry to this node.
And we are defining some variables here and we have to find never will.
And it contains the fish value.
So whenever I use this ampersand name, uh, semicolon, then this fish will get to replace it here.
Whenever XML parser on this ampersand name, it will go, it will go and take this and this and it has
the name entity which is the very first.
So this fish value will get splicer here.
So in the same way, what if I just take this, uh, system, uh, file etsi puzzle so you can see if
this is the protocol and it turns XML parser to read the contents are to get the contents from this
file.
Switchfoot, it's impossible.
So this system is that you need to search in the system and search for the file at possibility.
So I'm just using the route and present.
So this really defines to this entity, which is to read the system for positively.
So that's I think I hope you have understood that what these are these guys are saying here.
Let me now let's go an expert in this.
I have already run this server and open this machine.
So now I have gone gone into this home and we have this better area now, we can submit our payload,
you can also go to the Xixi payloads.
And at this getup, you have so many parents here and you can see the basic example to get the information,
John Doe and simple entity John Doe.
So let me show you this, how it works.
Now, the output will be Jundal.
Because it takes the dawn value and then it goes and as, for example, variabilities, so we're going
to put this Dundar.
No.
We can also see the same, but we can see that at Sea Shadowfax.
And Shotover consists of hashes for users, so we I think we don't have access to the server, don't
have access to the shuttle and you can also perform this dangerous service using all these, uh, uh,
random junk data.
So we are not going to do that.
So try to display your own name using axes, using any Perl.
So let me call with DISPELL or.
And then writing copy paste it in here, let me change it to.
And then I'm going to change this to Nicole, so let me start with this, and you can see my name has
been successfully.
So let me click on this computer, see if you can read that possibly.
Sorry.
So it's covid is exceptional and it does replace this shot of stability.
Sodium, sodium.
Let's pass, that will be.
And there you can see the contents of this possibility has been displayed.
And you can see there is a user name calling for an end user group and some information are home for
is the author of this FAQ on user NIBIN, Banshee's The Shell, which can be used by the fact that we
got some information.
What is the name of the user?
Netivot, which is Furqan?
And where is the arrogance as you look at it so it's easy to get in and let me show you in a home for
home.
Of our second and third associate.
So I would underscore say this is a private key for this, uh, Furqan user, let me submit this and
then we got this, uh, private key for this Furqan user.
So let me copy this part.
Sorry, but it will be manually.
Home Phalcon bought a Secich and highly underscore Arissa.
So what what are the frustrating items from the Falcons key?
So let me copy a bunch of these characters.
I think these are more than willing to let me open a Python interpreter.
So it's easy to see.
So I'm just quoting it as a and what I will do is I want to ask from Dero to 70, which is the 18 Karatas.
So non-literary with the syntax I would expect in the Python section.
Now we have got the fascinating characters.
So these are like indexers do makes one, two, three, four and so on to something.
Is that fascinating?
Characters write this and submit this.
So we have successfully completed this room.
Uh, sorry, this just part.
So what we'll learn is when there is an answer and when it's going to pass this to define an external
entity and you can just, uh, put the file name you want to read, and then you need to, uh, set
the ampersand variable.
So whenever that's been read by the actual, then it will read the, uh, system file and the contents
will be displayed.
So I hope you understood this is what you need to know about this XML external entity.
And, uh, I also advise you to check out this pilot and perform all these, uh, dinner service.
And Arafeh local fare includes an extra grassers at Google and, uh, uh, for other actors, pyrates.