11.7 Lab: Exploiting XInclude to retrieve files | 2024

8 months ago 66

BOOK THIS SPACE FOR AD

ARTICLE AD

This lab has a “Check stock” feature that embeds the user input inside a server-side XML document that is subsequently parsed. Because you don’t control the entire XML document you can’t define a DTD to launch a classic XXE attack. To solve the lab, inject an XInclude statement to retrieve the contents of the /etc/passwd file | Karthikeyan Nagaraj

This lab has a “Check stock” feature that embeds the user input inside a server-side XML document that is subsequently parsed.

Because you don’t control the entire XML document you can’t define a DTD to launch a classic XXE attack.

To solve the lab, inject an XInclude statement to retrieve the contents of the /etc/passwd file.

Visit a product page, click “Check stock”, and intercept the resulting POST request in Burp Suite.Set the value of the productId parameter to:

3. Send the request and the lab will be solved

Read Entire Article