Advanced XXE ExploitationExercise 2: External DTD (App port 8022)

Philippe ArteauGoSecure Countertack

19/06/2019Slides: http://bit.ly/xxeparis

Direct response from XXE

Not ideal In some case, you might have no response

Side-Channel XXE with external DTD

XML

Request DTD

Request FTP

XML payload

DTD host over HTTP

XML payload

FTP service

Edit FTP to have something unique

In real test, you should test using :- 443- 80- 21

1. Send XML payload

2. DTD is loaded!

3. FTP URL is evaluated!

Putting the pieces together

Using repeater efficiently with HackVertor

Using the fake FTP server interactivelly

Bonus:Try to get RCE on the server

QuestionS ?

Contactparteau@gosecure.cagosecure.net/blog/@h3xStream @GoSecure_Inc