the next lab that we're going to talk about is actually an example of using X. X. E.
To cause the target server to send a request. So it's X X. E. Two S. S. R.
F which is short for server side request forgery.
Now again when you're doing these challenges you have to read the content of it.
And let's see what we are supposed to do in here.
The lab is running a simulated ec two metadata endpoint.
So Ec two is just the type of servers that you can get from amazon. It's given us the I.
P.
So we're assuming that we already know that there is
a server that is running on this specific I.
P.
And this endpoint can be used to retrieve data about the instance,
some of which might be sensitive to solve this.
We're supposed to perform a server side request
forgery
that obtains the servers I am secret key.
So like I said these vulnerabilities can be used to get useful data and what
we're gonna try to do is communicate with this particular server through an X.
X. E vulnerability. So if you simply copy this I. P.
Or copy this location and loaded in your browser, you'll see that this will not work
because
the server that is running on this I. P.
Is configured to only work if a specific server communicates with it.
So it refuses connections that it gets from all of the servers around the world
and it only accepts connections from the web application that is designed to use it.
That's why we need to use an X X.
E to cause the target server that we are manipulating to communicate with it.
Perfect. We have the lab here.
Again, it's a website that is very similar to the previous one.
So we're just going to click on any product. We're gonna turn on our interceptor.
We're gonna click on check stalk and Perfect.
As you can see again, we have the content type xml. We can see the xml in here.
So we're gonna test for X X the vulnerabilities.
We're gonna right click and send it to the repeater
and we're going to manipulate it in the repeater.
Let's send a normal request at the start without any manipulation.
Again, we can see the result here. Perfect. No issues at all.
And we're actually going to use the exact same exploit or the exact same payload.
The only difference is instead of giving it a local file in here,
we're actually gonna give it
and I P. Which is the I. P.
Of the server that we want to communicate with which is the server.
And obviously we're going to remove the file directive in here.
So right now we're basically just seeing another use
of this specific payload in X x E vulnerabilities.
And instead of reading a file on the local server,
we're actually gonna use the local server that this data is running the
web application to communicate with another server that is at this location.
So simply instead of putting a file pattern here,
we're put in a location for another server.
Now we're assuming through the information gathering
stage or maybe through other exploitation,
we managed to discover the server and we know
that this server can lead to sensitive information.
So we're giving this in this scenario, that's why we're doing it this way.
So we're going to do that the same way that we've done it before.
We're just gonna inject that in here and in the product I. D.
We're gonna refer to the variable
and we're gonna send it.
And as you can see now it's saying that there is an invalid product I. D. Latest.
So it's actually the directing us to another path on the
target server and the other path is forward slash latest.
So we're simply gonna type latest in here
and send it again.
Now it's given us another path metadata. So we're gonna put that,
send it again.
Next one is I am
send it.
Next one is security credentials,
paste it here. Send it.
Next one is admin
send it.
And perfect.
Finally, as you can see we managed to get the security credentials, the access key I.
D. The secret access key, the token and the expiring.
So in this example we're basically using the exact same exploit in here.
The same payload.
The only difference is instead of specifying a file path,
a local file path we actually specified remote server to communicate with and
we used that to actually gather or extract information from that server.
Now this is useful in two ways.
The first is the scenario that we've just seen to
retrieve data from an internal resource that we cannot access.
And only the target web server can access.
The second scenario that it can be very useful in is if we have an out of bound X. X. E.
What we mean by act of bound X X. Is
is
previously in the first example when we were
exploiting the server and playing with it,
we were actually getting useful error messages.
Sometimes in some scenarios you might not get useful error messages so you
could execute something like this and you won't see the results back.
You have no way of displaying the results back or you have no no error messages.
Therefore you don't know if your exploit is working or not.
In that case you can actually send this request to a server that you own.
So you can simply run your own server and put the I. P. Of your own server in here.
And when you send this request,
the target web server will send this request to
your own server and therefore you'll be able to
see in the logs of your server that you got a request from the target web server.
And therefore you will note that the target web server has an X. X. E vulnerability