in today's class, we're gonna talk about xml.
External entity injection short for that is X X E.
I know it's a mouthful before we can talk about these vulnerabilities.
We need to understand what xml is
and what we mean by xml. First of all, it's short for extensible markup language.
So similar to html, it's a markup language,
but html is used to display elements on the screen.
So if you open up a html page, right click and view the source of the page,
you'll be able to see the code responsible for the elements that you see on screen.
So you'll see the code that renders the images, the videos and and so on.
With xml, it's designed to transport and store data. That's all.
It's not used to display anything. It's not used to compute or calculate anything.
It's simply designed to transport data and store
it in a predefined and organized manner.
So what do we mean by this? Let's have a look at an example.
This is an example of some X M L. Code or markup.
And as you can see, we can have elements,
the elements would start and close with a smaller and greater tag.
And every time you open up an element you have to close it with the same name,
but you start with a forward slash.
So the note gets closed with the forward slash. Note.
The two gets closed with a forward slash two and so on.
Now as you can see this. Markup in here does not do anything.
It simply just contains data and it categorizes
this data or puts it inside entities.
So we know to this, whatever this data is,
the two elements of it is to
the from element of it is johnny,
the heading element is a reminder and the body is this,
but we don't know what's this supposed to do or how it's supposed to be you.
But this is the whole idea of xml
then this data is sent and transported in this very
well designed manner when it's received by a server,
the server is going to interpret it and do
whatever the programmer wants to do with it.
So you could have an application on the server that will use this data to send an
email from a person called johnny to a person
called tove with this heading with this body.
You could also have it set a reminder.
You can pass this to a number of applications and
have each one of them do something different with it.
The list goes on and the uses are infinite.
The idea is xml is designed to store and transport data not to do anything with it.
So if we look at this example, no work has been done by xml.
So xml itself is just a markup language, it doesn't really do anything.
But what we're interested in today is X x E,
which is a type of vulnerabilities that happen when xml is used.
So I'm just spending this time in here to explain what xml is to you.
But what we really want to do is we want to exploit xml external entity injections,
which is called X x E.
So well actually, first have an example on how Xml works,
and then we will also see how to discover and exploit X x is.