Performing XXE attacks
XXE is a vulnerability that targets applications parsing XML. Attackers can manipulate the XML input with arbitrary commands and send those commands as external entity references within the XML structure. The XML is then executed by a weakly configured parser, giving the attacker the requested resource.
Getting ready
Log in to your PortSwigger account. We will be using a PortSwigger lab – Lab: Exploiting XXE using external entities to retrieve files (https://portswigger.net/web-security/xxe/lab-exploiting-xxe-to-retrieve-files) – to exploit an XML parser vulnerability in our target application.
How to do it...
- Log in, go to Lab: Exploiting XXE using external entities to retrieve files, and click the Access the lab button to start your instance.
Figure 11.1 – Lab lesson
- After your instance of the lab loads, use the Burp Suite browser to capture your traffic. Click around the site and...
