Ilan`s Web App Module PPT`S

1. Web Attacks
Vulnerabilities
XXE
1

2. 2
Extensible Markup Language (XML)
What is XML?
• XML stands for eXtensible Markup Language
• XML is a markup language much like HTML
• XML was designed to store and transport data
• XML was designed to be self-descriptive
The Difference Between XML and HTML
XML and HTML were designed with different goals:
• XML was designed to carry data - with focus on what data is
• HTML was designed to display data - with focus on how data looks
• XML tags are not predefined like HTML tags are

3. 3
XML External Entity (XXE)
XXE
An XML External Entity attack is a type of attack
against an application that parses XML input.
It is possible to exploit XML vulnerability processors
if they can upload XML or include hostile content in
an XML document, exploiting vulnerable code.
This attack occurs when XML input containing a
reference to an external entity is processed by a
weakly configured XML parser. This attack may lead
to the disclosure of confidential data, denial of
service, server-side request forgery, port scanning
from the perspective of the machine where the
parser is located, and other system impacts.

4. XXE -Example
Example:
Use burpsuite to catch the request.
We got 1 flaxable parameter using XML (login).
Send the request to the repeater.
4

5. XXE -Example
5
Syntax for XXE Attack:
<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE Header [ <!ENTITY xxe SYSTEM "file:///etc/passwd" >]>
<reset><login>&xxe;</login><secret>Any bugs?</secret></reset>
We replace the user login (hackeru) with the variable we have
created, and send a new request to the server.
The request will force the server to display files from the local file
system of the server, in our example, we are requesting to show
the passwd file that located in /etc/passwd.

6. 6
XXE

7. 7
XXE Prevention
Protection
To Prevent XXE, need to change the
configuration of XML.
Configuration:
xmlInputFactory.setProperty(XMLInputFactory.SUPPORT_DTD, false);
// This disables DTDs entirely for that factory
xmlInputFactory.setProperty("javax.xml.stream.isSupportingExternalEntities", false);
// disable external entities