So well actually first have an example on how Xml works and
then we will also see how to discover and exploit X.
X. Is.
And as I mentioned in my previous classes, first of all you want to use this website,
like any other website that you would use just to get an idea on how it works.
So for example we can see we have a number of products.
If we click on the view details you'll get the actual product,
you'll see in here at the bottom,
we're able to check the stock of this product and you
can select which store you want to check the stock in.
If you click on check stock,
you'll see that this functionality will work and
you're gonna get the number of units available.
And then if we also look at the U. R. L. Bar in here, you'll see that we have product I. D.
Equals four.
So again you can test this for all of the vulnerabilities
that we learn in my courses and in my classes here.
But today what we're trying to do is discover an XXY. So let's have an example of it.
I'm gonna turn on my interceptor and we're going
to use this feature again the check stock.
So we're gonna click on check stock and as you can see once
we click on that you will notice that we have a post request.
The post request is being sent to this path
and if we look down you will see that the
content type in here is application forward slash xml.
So this should be a clue that this web application is using xml.
For whatever reason we want. We're still not sure.
Now if you read further, you'll notice in the body in here we have some markup.
And this markup looks very similar to what I showed you earlier.
And if you read the first line of this markup,
you'll see xml version one encoding whatever.
So we know that this web application, it's sending the data as xml.
We can see the actual xml markup and if you
read it you'll see that it is very human readable.
It doesn't look like gibberish or something that is hard to understand.
So you can see that it is sending its setting an entity called stock. Check.
The next entity in this, in this entity is product I. D.
And the value of that is for you can see that the product I. D.
Is closed with the forward slash. And then the next thing is the store I. D.
And the store I. D. Is number one.
So now we know that when we click on check stock in here,
the website is going to send data to the web application as X.
M. L. And in this data it's going to specify the product I. D. And the store I. D.
So as usual, and as we have learned throughout all of my previous classes.
Whenever we see data being sent to this web server or to the web application,
we should start interfering with this data.
See if we can manipulate it in a way that
will cause the web application or the and the server
site to do something that is good for us to
reveal some information or give us access and so on.
So when we want to manipulate data like this
you could manipulate it in here and just forward.
But you know every time you do that you have to do it
press forward and see the result here in the window on the left.
But a quicker way would be to right click and send it to the repeater.
And then when we go to the repeater we will have the
exact same request and we can send it and see the response.
So again now when we sent it you can see the response was 854 which is what
we see in here when we actually asked for the stock it was 854 as well.
So again we sent the request as is with that manipulation.
So the next step would be to actually start
manipulating this and see how it's going to work.
You can start with manipulating data in here.
For example you could start adding quotes and adding all these things that we
learned before to see if you can get it to crash or do whatever.
You can see when we do that. It's just giving us a message saying invalid product I. d.
four.
Now since this web application is using X. M. L.
We can create an external entity, hence the name of this vulnerability.
It's called xml External entity injection.
So we're actually gonna use a feature of Xml to see if we can manipulate this X. M. L.
Document that is being sent or xml markup to give us useful data.
So we're gonna paste this external entity.
This line right here is basically a definition for an external entity in xml.
What we're simply doing is we're defining an XmL entity. We're defining a dark type.
We're calling it a test and we're creating an external entity.
The name of this external entity is X X E.
So you can call this name whatever name you want.
The most important part in here is the use of the system,
which basically can be used to read files on the system or even fetch you or else.
So what we're saying is we want to read a file on the
local system and the location of this file is E T C password.
This can be any file you want if you manage to read a local file on the target computer,
regardless of what file it is.
This will still be considered a vulnerability.
So in a bug bounty or in a pen test if you manage to read
files on the target server that you're not supposed to be able to read,
then you have discovered a vulnerability.
You can learn more about this if you want to learn more about xml but this you can
think of this as simply a payload that we're
going to use to exploit X x e vulnerabilities.
I will also include a cheat sheet within this class
of a lot of other payloads that you can use.
So we're going to place this payload in here
and if we send this request now
you'll notice
that we got the exact same response as before.
So nothing has happened.
The reason for this.
We created this doc type and we created this external entity in here
and we called it X X E
and what this will do, it will go ahead and it will load whatever content in this file,
A T C password
and the value of this will be stored in the variable.
You can think of this as a variable that is called X X. E.
But we haven't read the value of this variable
But like I said earlier,
if you note in here whenever whatever we put here
instead of the four is being displayed in here.
So it's a an invalid product idea followed by whatever I put in here.
So if I simply put the X X.
The variable in here and send this request,
I should see the data that is stored in the xxi variable after invited product I.
D and then I should see the data that I want in here.
So let's try it in xml if you want to refer to a variable,
you type an ampersand followed by the variable name followed by a semi colon.
So like I said this line in here is going to execute this.
It's gonna read file the file that is taller in E. T. C. Password.
The value is going to be stored in X. X. E. And we're simply referring to the X. X.
The variable in here because we know whatever we put in here. If it's an invalid I. D.
Which it is, it will be displayed to us in the response.
So we're gonna send
and perfect. Now as you can see we're seeing invalid product I. D.
And the result of that is whatever we put in here which is the value that
was stored in the Xxi which is the content of the file that is in E.
T. C. Password.
So once you are at this stage you basically managed to discover an X. X.
The vulnerability and you can submit this as a bug.
And you can also use this when pen testing and you can
obviously use it to read data from the target web server.
You might manage to read sensitive files and you can actually further
exploit this to do so much more on the target web server