🍡[Severity 4] XML External Entity

Notes about XML External Entity & the practical.

An XML External Entity (XXE) is a vulnerability that abuses the features of XML parsers or data. It allows an attacker to interact with any backend or external systems that the application itself can access and allow the attacker to read the file on that system.

In-band XXE - the attacker can recieve an immediate respones to the XXE payload

Out-of-band XXE (blind XXE) - no immediate response from the web application and the attacker has to reflect the output of their XXE payload to some other file or their own server

XML (Extensible Markup Language) - markup language that defines a set of rules for encoding documents in a format that is both human and machine-readable. Stores and transports data. It can also be used on any platform. It simplifies data sharing between various systems and allows validation using DTD and Schema.

It is not cumpulsory to have XML prolog in XML documents.

We can validate XML documents against a schema.

We specifiy XML version and encoding in a XML document by using XML prolog.

To define a new element, we can use !ELEMENT.

To define a root element, we can use !DOCTYPE.

To define a new entity, we can use !ENTITY.

The username in /etc/passwd is "falcon".

Falcon's ssh key is located in /home/falcon/.ssh/id_rsa

The first 18 characters of Falcon's private key is MIIEogIBAAKCAQEA7b.