Hey there. Welcome back.
In our previous lessons,
we looked at SQL base Injection attacks.
In this one, we're going to focus on
XML External Entity Injection
sometimes referred to as XML Injection or even XXE.
I'm going to call it XML Injection.
In this lesson, we're going to be working on
an a basic understanding of how
XML works before we can get started.
After this lesson, you'll be able to
define XXE or XML Injection,
discuss the dangers of simply acting
on user provided data without care,
then use an XML viewer
and a text editor to play around with code.
Let's dig into it. Hi everyone.
The next type of injection flaw we're
going to look at is XXE.
XXE stands for XML External Entity Attacks.
Much like SQL Injection,
this could be a devastating attack,
and we're going to look at it because it's
one of the two lessons that WebGoat offers.
So we already covered SQL Injection.
We already covered cross-site
scripting both of which are
injection attacks on different endpoints,
the client or the server.
We're just going to go through XXE as well to show
a variant of injection attacks and how taking
data from a user and simply acting on
it without care could cause some issues for us.
Now in order for us to work with XXE,
we need to understand how XML works.
So I wanted to play around a little bit
with an XML Parser.
Just get a basic idea of how XML
works if you have no background in XML,
I am by no means an expert in XML.
It's just a tool and I've used it before.
So if you feel like you understand XML really well,
feel free to skip this video
and meet us on the next video,
and we'll continue from there.
So the remainder of this video is going to be
getting a basic understanding of how XML works.
So I like this use this website.
Let's see if I can find it. Yeah, there it is.
The countwordsfree.com which has an XML viewer.
An XML data looks like something like this,
and if you can convert that to JSON,
it'll come out something like this.
Now, I'm not going to do the work in here.
We're going to do the processing in here,
but we're going to actually use a text editor
to play around with our code,
and I'm going to snap this window to the left
and I'm going to zoom out of it
simply because we're just going to
use it as a staging area.
All right. So XML is pretty cool.
It's just like HTML,
is a markup language.
I shouldn't say just like HTML.
It's similar to HTML,
that is a markup language,
and some of the syntax might look very familiar.
So in it, you can define your element types,
and from there, you could create your objects.
So let's play around with it and see what we get.
So I am going to create an element.
I'm going to convert my indents to spaces.
So that it's all pretty and we can see where we're doing.
So I am going to define
an element type of type foo maybe,
and I'll tell it that I can put any type of data.
As you can see, I have PC data here.
I'm just going to put any for my foo objects.
So I can delete this,
and I can have foo.
In foo, maybe I can have author,
and in my author and I'll end my foo.
Maybe author should be enjoying.
I'll just do my own name for now.
I'm going to paste that in here, and convert that.
You can see that it just creates
a JSON object for us and a nested object foo.
Let's see, I can also add text maybe.
So if I copy this over,
you'll notice something like this, and
let me just add a copyright.
We'll add a copyright element.
I'll just call it copy, and
I'll just say any data can go in there.
There's a terrible practice.
We're just trying to learn.
So if I've copy in here,
and I can say, "Copyright 2018."
Let's copy this over again and
see what it looks like in JSON.
Perfect. Now, let's make a root object.
So I'm going to say ELEMENT root ANY,
and I'm going to put root here and my root here,
and so just pretty and readable.
I'm going to Indent this. Let's test
that out to make sure I didn't break anything.
Perfect. So we have a root object.
The root object has foo,
and my intent is to say,
the root object is our most outer object.
Think of it like an array and in it,
we're going to have a bunch of foo objects.
I'm going to re-indent this code so that it looks pretty.
So this is where we ended up with.
So now, we have a root object and in it,
we have two different foo objects.
Let's test that out.
I'll make sure I don't break anything.
Perfect. So works perfectly fine as expected.
So as you can see, I'm trying to create
a use case to demonstrate one of the features of XML,
and that is to be able to reference data.
So say in the year 2019,
I needed to come here.
Instead of doing search and replace on copyright 2019,
I can make my job a little bit easier,
and define my own entity,
and simply replace with it the copyright dates.
So I'm just going to say date, I'll call a date,
and then maybe I'll just say, copyright 2018.
The idea behind this is so that I don't have to replace
every single one of these
every single year or I can simply reference to a date.
I can do that by going and
date which is what I named my object up here.
Semicolon. So I'm just going to paste that in here.
Now, the expectation is
going from the previous one
where I actually had written copyright
2018 in every single one of
the copy objects which printed it out for me.
I want the same end result so
that my JSON object should look the same.
But my XML object looks like this. So let's try that out.
So we get the same end result.
So basically, what this XML Parser is doing is
it's replacing in my root object,
in my foo object,
the copyright date with whatever I reference there.
Now technically, I could also
reference things on my file system.
So wherever this XML Parser is sitting,
I could reference that object on the file system,
and I don't have the facilities to demonstrate that here,
but we're going to do that in WebGoat on the next video.