Hey there. Welcome back. In the previous video, we
talked about how XML works, how XML entities work, and how we can reference
various things outside of an XML object. The idea behind this lesson and the rest of this module
is exploiting some of that and talking about how we can go about finding what
we need to exploit. Essentially, the process of
discovering vulnerabilities. Before viewing this lesson, I hope you've taken
some time to explore your assigned reading of the OWASP XXE
Prevention Cheat Sheet. It's a great resource
and you can use it to fill any gaps you have
in your prior knowledge. We're just refresh to
focus on this topic. After this lesson, you'll be able to describe the process I demonstrate of
an XML injection attack to list the root
directory of a server. Thinking back to
our threat modeling work, this is the same thing
as compromising the confidentiality of
some victim server. Before we start, you should
know that we're going to be running everything
through fireworks for the remainder of this module, or at least I am, just so that we can intercept
the data in my proxy. If you forgot how to set that up, just reference
the video where we talk about setting up
the proxy and how to configure it so that not all of your traffic is going
through the proxy. I'm using Firefox because it allows me to specifically set the proxy for my browser and not my entire system.
Let's get started. Let's play around with
it and see what we get. I'm going to bring
up my Burp Proxy. I'm going to clear
the history just because it's been
running for a while. There's going to be
a lot of noise in here. I wouldn't really worry about it. We'll know when we have
the data that we need, because anything that
we do is a post. So we'll see it
come up as a post, and we can modify our post. Another thing to make
your life a little bit easier, by default, Burp orders things
from top to bottom, meaning oldest requests on top and newest requests
on the bottom. I actually flip that just because I can then
always keep it up top, and I know my newest
requests are up top. So we're going to just
play around with this. The idea behind this is they
want us to add a comment and do an XXE injection trying to list their root directory
on this file system. So going back to how XML works, that seems pretty
interesting to do. Obviously, it would be very useful to know
what files I have on there fastest stem and maybe even open it and reference
some of those items. So let's go ahead and give it a test comment to see
what it looks like. So I just comment the tests. If I go to my Burp, we see a post. If we look in there,
it looks like we're just commenting
an XML object here. So I'm going to copy
that out and put it in our trusted IDE. I'm going to re-indent this code. Let me indent it properly. Now it doesn't need
to be indented, but it makes it easier
for us to read it. Perfect. So this is
essentially what it's posting. Now, if I copy this, the same thing that
we posted before, I've just cleaned it up. I'm going to copy that, and our request with
our posts which is highlighted from before I right-click on it and
send it to the repeater. If you go to the repeater, you'll see essentially
what was commented before. So I'm going to replace
this with what I have here. Now we already come into test. So I'm going to change
this to test2, copy this, highlight everything
here, erase it, paste my new post and hit Go. The expectation is
when I come back here, if I refresh this page I want to see a test2
in here as well. So I'm going to refresh that, and sure enough there's
a test2 in here. So we know that we can modify
what's being posted here. All I had to do was
hit Go on my repeater. So now we can modify this. The idea is we want to reference something
in their file system. In a previous video when we
were talking about this, we talked about how
entities can be referenced by simply referencing
to something like this. So you define your entity
and you can reference it. The question is
how can you define an entity on their file system? Now in the next video, we're going to show you how to do that. But to go through our thought
processes for this, open up Chrome,
open up a new tab, and maybe just search
XXE Cheat Sheet. OWASP comes up as
our cheat sheet. We can scroll through
and see if we can find anything that's interesting. Shows the code that's vulnerable and how the various
code segments work. There's also an explanation of XXE processing and
what goes wrong, and there may be some hints in here on how to go
about doing this. So good and give it a try, and we'll come back on the next video and show you
how to do this.