DISCOVERY
METHOD 1: XML EXPECTED INPUT
#find web pages that accept an XML user input
root@oco:~$ burpsuite
root@oco:~$ BROWSER > FoxyProxy > Burp
root@oco:~$ BURP SUITE > Proxy > Intercept is on
root@oco:~$ BROWSER > {targetSite:port}
input field: 127.0.0.1
...
* submit the expected user input
BURP > Proxy > Intercept > Raw
Request
...
POST /submitDetails.php HTTP/1.1
<?xml version="1.0" encoding="UTF-8"?>
<root>
<name>First</name>
<tel></tel>
<email>[email protected]</email>
<message>This is a test email</message>
</root>
* forms that appears to be sending user input data in an XML format can be tested for potential XXE vulnerability
- the target page may be vulnerable to XXE injection if the user input isn't properly sanitized or safely parsed
#identify which elements are being displayed IOT know which elements to injext malicious xml input
#if no elements are displayed, utilize blind xxe injection method
BURP > Repeater
Request
...
<?xml version="1.0" encoding="UTF-8"?>
<root>
<name>First</name>
<tel></tel>
<email>[email protected]</email>
<message>This is a test email</message>
</root>
Response
...
HTTP/1.1 200 OK
check your email [email protected] for verification...
* the email field is reflected in the response and may be vulnerable to xxe injectionMETHOD 2:
METHOD 3: JSON TO XML CONVERSION
ERROR-BASED
this discovery method is used when the web application doesn't write any output from the attacker's XML input entities. thus the attacker is blind to the XML output and wouldn't be able to retrieve any file content using usual methods. in this case, attackers can test whether the webapp displays runtime errors such as PHP errors. this vulnerability can be utilized if the webapp does not have proper exception handling for the XML input. this flaw can be used to read the output of the XXE exploit
Last updated