1 00:00:00,420 --> 00:00:04,490 So as I said before, XML is a very popular data format. 2 00:00:05,440 --> 00:00:10,480 It's used in just about everything from Web services to documents and more. 3 00:00:11,410 --> 00:00:16,450 And an XML document does not only consist of elements and attributes and data. 4 00:00:18,150 --> 00:00:23,920 You can also define a type definition for a document itself. 5 00:00:25,080 --> 00:00:29,340 So at this point, you can request or include some resources from the system. 6 00:00:29,940 --> 00:00:35,970 Then to interpret this XML data, an application needs an XML parser. 7 00:00:37,670 --> 00:00:42,530 An XML external entity attack or excess E injections. 8 00:00:43,770 --> 00:00:45,320 That's where you're going to find him. 9 00:00:47,100 --> 00:00:55,050 So this attack occurs when XML input containing a reference to an external entity is processed by a 10 00:00:55,350 --> 00:00:57,660 weekly configured XML parser. 11 00:00:59,000 --> 00:01:06,050 So it may just lead to the disclosure of confidential data, denial of service, server side request 12 00:01:06,050 --> 00:01:12,380 forgery, port scanning from the perspective of the machine where the person is located and many other 13 00:01:12,380 --> 00:01:13,340 system impacts. 14 00:01:13,520 --> 00:01:14,750 I mean, this is big, right? 15 00:01:16,100 --> 00:01:20,810 So in this lesson, we are going to cover X, X, E attacks. 16 00:01:22,260 --> 00:01:24,960 So let's open up Cali and log in to be Web. 17 00:01:26,010 --> 00:01:29,220 Then choose XML external entity attacks. 18 00:01:31,860 --> 00:01:35,040 Now, the page display looks like this. 19 00:01:36,350 --> 00:01:39,530 So now to see more, let's view the page source. 20 00:01:40,810 --> 00:01:42,730 OK, so I see the JavaScript code here. 21 00:01:43,710 --> 00:01:52,500 And this code makes an Ajax request to execs to dump BHP and it sends the parameters in an XML file 22 00:01:52,500 --> 00:01:53,740 as the post data. 23 00:01:54,570 --> 00:01:57,810 So before doing anything on the page, go to terminal. 24 00:01:58,740 --> 00:02:08,610 Open xixi one P and scroll down a few lines, and here is the JavaScript file in the page source. 25 00:02:10,760 --> 00:02:14,300 So I think there is nothing problematic here for now. 26 00:02:15,380 --> 00:02:16,880 So let's view the other file. 27 00:02:18,410 --> 00:02:26,360 I guess this page will open doors for us, perhaps even many doors, so online 24, the data in the 28 00:02:26,360 --> 00:02:30,620 post request body is taken by the input rapper. 29 00:02:31,570 --> 00:02:34,300 Then this data is assigned to the body variable. 30 00:02:35,340 --> 00:02:42,170 And there is no check for low level and then naturally the body variable is loaded as an example while. 31 00:02:44,170 --> 00:02:48,220 And yeah, it looks like the rest is update code. 32 00:02:50,010 --> 00:02:54,720 Oh, and by the way, displaying an error is opened up on line 30. 33 00:02:56,240 --> 00:03:03,140 OK, so now for the other levels, yeah, it's a little bit different, so 978, the XML external entities 34 00:03:03,140 --> 00:03:04,040 are disabled. 35 00:03:06,390 --> 00:03:07,650 The line is commented. 36 00:03:08,790 --> 00:03:15,530 But for medium and high level, you can uncommented and the rest is the update code as well. 37 00:03:16,510 --> 00:03:17,590 And we can exit. 38 00:03:18,370 --> 00:03:20,110 OK, so now go to Firefox's. 39 00:03:21,450 --> 00:03:22,920 Enable Foxe proxy. 40 00:03:24,190 --> 00:03:28,480 And now I'm going to arrange the screen for you because I like this view. 41 00:03:29,960 --> 00:03:34,370 OK, so when you click this button, the request on the right is sent. 42 00:03:35,310 --> 00:03:40,500 Now, it's a post request and you can see the XML file below as the post data. 43 00:03:42,210 --> 00:03:45,570 And for this request, the detects Zimmel content. 44 00:03:47,190 --> 00:03:50,820 So you can view the XML tab or is it pretty? 45 00:03:52,440 --> 00:03:57,810 OK, so forward this request and the response contains just a message. 46 00:03:58,740 --> 00:03:59,700 OK, forward. 47 00:04:00,970 --> 00:04:05,970 Send the request to berp again and send it to the repeater tool as well. 48 00:04:07,330 --> 00:04:08,560 Then let it go. 49 00:04:10,150 --> 00:04:14,530 OK, so go to the repeater tab, let me maximize burb here. 50 00:04:15,890 --> 00:04:19,490 And now send this first request to check the connection. 51 00:04:21,120 --> 00:04:23,060 Perfect, so it updates be secret. 52 00:04:24,700 --> 00:04:27,580 And I'm going to change here to be one and send. 53 00:04:28,810 --> 00:04:30,460 And it's reflected the response. 54 00:04:31,710 --> 00:04:33,030 OK, so just write something. 55 00:04:34,360 --> 00:04:36,100 And it reflects that also. 56 00:04:37,380 --> 00:04:40,710 So instead of this extra Malfi are just based in this one. 57 00:04:42,720 --> 00:04:50,580 Now, my payload will define an external entity named XXXI and then it prints its value. 58 00:04:52,230 --> 00:04:52,980 And then Sam. 59 00:04:53,980 --> 00:04:54,760 Perfect. 60 00:04:54,820 --> 00:05:01,260 So this means that we can include external resources to that Zemel OK. 61 00:05:02,270 --> 00:05:04,670 Now I'm going to use this pelote. 62 00:05:05,830 --> 00:05:09,340 And it will bring us the content of the password file. 63 00:05:10,630 --> 00:05:13,190 And let's have a look at that payload carefully. 64 00:05:13,210 --> 00:05:18,970 It uses a file wrapper to point to the password file and it works well. 65 00:05:20,170 --> 00:05:25,480 OK, so now let's use one without this file rapper. 66 00:05:27,120 --> 00:05:28,290 And it works also. 67 00:05:29,840 --> 00:05:31,850 OK, so I'm going to pace this one. 68 00:05:33,430 --> 00:05:36,160 And it uses public instead of system. 69 00:05:39,370 --> 00:05:41,530 And we see the hostname. 70 00:05:43,370 --> 00:05:46,730 So now we can use another rapper to pull resources. 71 00:05:48,960 --> 00:05:51,810 But you can encode the file with his wrapper as well. 72 00:05:53,620 --> 00:05:54,640 So send the request. 73 00:05:55,980 --> 00:06:00,000 And the file is encoded, so copy the encoded part. 74 00:06:01,560 --> 00:06:02,700 Based on the decoder. 75 00:06:03,790 --> 00:06:05,920 Then decode is base64. 76 00:06:07,960 --> 00:06:10,750 And here is the content of the file. 77 00:06:12,250 --> 00:06:13,450 So go to the repeater. 78 00:06:15,560 --> 00:06:17,780 We can also view the code files. 79 00:06:19,810 --> 00:06:25,240 And I will advise you to use this wrapper with encoding when you want to pull code files, because in 80 00:06:25,240 --> 00:06:30,040 a normal pull request, that code can cause an XML execution error. 81 00:06:30,430 --> 00:06:30,970 Don't want that. 82 00:06:32,260 --> 00:06:33,520 OK, so send the request. 83 00:06:34,560 --> 00:06:37,110 And encoded result comes to copy it. 84 00:06:39,660 --> 00:06:41,310 And paste it to the decoder. 85 00:06:44,120 --> 00:06:45,140 Not as hex. 86 00:06:46,870 --> 00:06:50,650 And this is the code file of Portale that BHP. 87 00:06:52,400 --> 00:06:54,110 And we can change the file. 88 00:06:55,170 --> 00:06:55,920 And send. 89 00:06:57,160 --> 00:06:58,540 Copy the encode data. 90 00:06:59,580 --> 00:07:01,080 Pasted to the decoder. 91 00:07:02,550 --> 00:07:06,420 And you can have a look at the content of the first tab file. 92 00:07:08,020 --> 00:07:09,550 So paste this payload. 93 00:07:11,310 --> 00:07:14,130 This payload will cause it denial of service. 94 00:07:15,750 --> 00:07:21,780 So in the SML engine tries to load this file, the payload will be expanded into the memory and it will 95 00:07:21,960 --> 00:07:25,240 fill up the entire memory of the server. 96 00:07:25,980 --> 00:07:29,190 So that's how the denial of service will happen. 97 00:07:30,760 --> 00:07:32,050 OK, so then send. 98 00:07:33,830 --> 00:07:36,710 And you see that nothing appears on the response being. 99 00:07:37,650 --> 00:07:40,740 So now try to go to be rap or refresh the page. 100 00:07:41,770 --> 00:07:48,580 And you cannot accomplish to view the page so the server is not configured to prevent such an attack, 101 00:07:48,580 --> 00:07:51,370 it can cause some pretty serious problems. 102 00:07:53,310 --> 00:07:56,100 Thankfully, the Web server and beatboxes configured properly. 103 00:07:57,740 --> 00:08:00,440 And we will get an hour after 30 seconds. 104 00:08:00,860 --> 00:08:01,760 Far out.