Hello.
We'll see in this lesson a laboratory concerning the exploitation of vulnerabilities of type XML External
Entities. In the VVWA application from GitHub, I developed this laboratory accessible through
the XXE lab link, which allows you to understand what this vulnerability consists of and how it can
be mitigated. In the textarea.
there is a hypothetical XML document concerning a CD catalog.
And this is what the programer on the next page
expects to parse.
So by pressing on the process button, you can see that on the next page the XML is processed
and its content is printed, let's go back and see what happens if instead of sending the correct XML
you get an XML modified
As follows, this is an example of an XML external entities attack pattern, the theory of which I
explained in the previous lesson, and in this attack pattern
I have also prepared the possibility of accessing an external entity, specifically a file on the web
server's file system.
So the XML parser, if purely configured, will load the data from the indicated path.
So let's see then with this pattern, making it process on the next page, what happens.
And here it is.
The parser is vulnerable and is being tricked into processing an external entity
data. The content of a file.
So.
Let's see.
Oh, now
OK, how to mitigate this problem
Let's go to Visual Studio, back.
And
OK, let's go to the source page of the page that processes the XML file.
Here, and let's comment on the line of code that sets the DtdProcessing property to Parse
Yeah.
And uncomment the line that sets the property to the prohibit value.
So.
Thus blocking the possibility of passing an XML that defines a DTD.
So you can see the mitigation is very simple, but the important thing is to make sure what the default
value of this property is.
Now
Let's go
Back to run the application.
After applying the mitigation and let's see what happens.
If you try to inject the malicious pattern as before.
So.
Let's try as before to process the XML that defines a DTD.
OK, but
This time, as you can see, the possibility of parsing the XML file is blocked and the runtime
exception is thrown, which I deliberately didn't handle
to highlight the anomaly.
So.
Thank you for your kind attention.