WEBVTT - This file was automatically generated by VIMEO

1
00:00:02.300 --> 00:00:05.700
 Welcome back to XML external entity session. In

2
00:00:05.700 --> 00:00:08.500
 this second part. We will exploit our intentionally, vulnerable

3
00:00:08.500 --> 00:00:11.500
 application to get access to some sensitive data.

4
00:00:11.300 --> 00:00:14.800
 We will jump straight to the ends on exploitation,

5
00:00:14.800 --> 00:00:17.100
 and then move on to the mitigation parts.

6
00:00:20.100 --> 00:00:23.500
 We should look for some upload feature so that we can upload the malicious

7
00:00:23.500 --> 00:00:26.700
 XML file. Let's see, what features Anonymous users

8
00:00:26.700 --> 00:00:27.800
 have access to.

9
00:00:39.400 --> 00:00:42.500
 The customer feedback form does not allow any bloats and

10
00:00:42.500 --> 00:00:45.900
 is anonymous users. We don't have that much features. Let's

11
00:00:45.900 --> 00:00:47.700
 sign up for a regular user account.

12
00:01:24.600 --> 00:01:27.600
 Okay, let's check the same features, but now is authenticated

13
00:01:27.600 --> 00:01:28.100
 users.

14
00:01:32.500 --> 00:01:34.600
 Customer feedback form Remains the Same.

15
00:01:36.300 --> 00:01:37.800
 Complaint is a new feature.

16
00:01:41.200 --> 00:01:44.400
 And this time it looks like we will be able to upload some files. Let's

17
00:01:44.400 --> 00:01:45.300
 prepare something.

18
00:01:48.700 --> 00:01:51.600
 This is our militias XML file. We

19
00:01:51.600 --> 00:01:54.500
 declare an external entity xxe whose

20
00:01:54.500 --> 00:01:57.500
 content should be loaded from a specific file. This

21
00:01:57.500 --> 00:02:01.400
 file is where Linux system store user account information. If

22
00:02:01.400 --> 00:02:04.500
 XML files are allowed and processed by a vulnerable XML

23
00:02:04.500 --> 00:02:07.400
 processor, then it should load a file and replace

24
00:02:07.400 --> 00:02:10.300
 our entity inside the message tag by its content.

25
00:02:14.400 --> 00:02:17.400
 Let's open developer tools so that we can inspect Network traffic.

26
00:02:40.500 --> 00:02:43.900
 Apparently XML is not an expectable upload format,

27
00:02:43.900 --> 00:02:45.200
 but let's see what happens.

28
00:02:54.100 --> 00:02:56.500
 We've got an error message. Let's inspect it.

29
00:03:07.200 --> 00:03:10.400
 The request includes our XML file content and

30
00:03:10.400 --> 00:03:12.300
 response shows an error message.

31
00:03:23.400 --> 00:03:26.700
 It looks like our XML file content is partially returned

32
00:03:26.700 --> 00:03:28.200
 as part of, their her message.

33
00:03:37.600 --> 00:03:40.200
 Inside the message tag. We have the content of

34
00:03:40.200 --> 00:03:43.300
 the passwd file. Let's

35
00:03:43.300 --> 00:03:45.300
 see what else we can get from the system.

36
00:03:54.300 --> 00:03:56.800
 Fingerprinting, the operating system can be interesting.

37
00:04:25.300 --> 00:04:27.400
 Again, the same HTTP error response.

38
00:04:29.800 --> 00:04:32.500
 We also get the same error message, including our

39
00:04:32.500 --> 00:04:35.800
 XML file content and information

40
00:04:35.800 --> 00:04:38.200
 about the operating system. Jewish drop is running gun.

41
00:04:40.400 --> 00:04:43.300
 We could keep going Gathering contents from the server, but

42
00:04:43.400 --> 00:04:44.400
 let's move forward.

43
00:04:46.400 --> 00:04:50.200
 In the third. And last part of the session, we will discuss XML

44
00:04:49.200 --> 00:04:51.900
 external, entities, mitigation.