1

I am testing web application with functionality of file upload. The only possible file format is XML. The content of the file saved in XML attributes is then presented on the separate page.

For example XML file looks like this:

<?xml version="1.0" encoding="utf-8"?>
<Request xmlns="http://www.w3.org/1.0">
<Body CaseId="Test/123656">
    <person gender="female">
    <note date="2008-01-10">
</Body>
</Request>

The value of CaseID, gender and date is than presented on another page. Is it possible to send somehow XSS payload in attribute value if web application blocks "<"? I would like to test also XXE, is it possible to reference to external entity in attribute value?

Improve this question
1
  • it depends on how the data is displayed. you can use attrib events to own instead of script tags.
    – dandavis
    Commented Nov 17, 2017 at 20:02

1 Answer 1

Reset to default
1

XML Parsers usually interpret Unicode so you could use the format \u00HH and bypass validations for <>,for example:

\u003Cscript\u003Ealert(1);\u003C/script\u003E

When XML Parser read the data structure to show on view, then it interprets the Unicode Characters and the result is the following:

<script>alert(1);</script>

I hope this information helps you.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .