XXE-study - This repository contains various XXE labs set up f

项目说明

XXE Study

This repository contains XXE labs set up for different languages and their different parsers.
This may alternatively serve as a playground to test with scanners / WAF rules / Secure Configuration settings.

Most updated parsers does not allow external entities by default. In this lab, they are deliberately mis-configured to allow external entities.

A en

| Language | Parser Used | App | Remarks |
| -------- | --------------------------------------- | ---------------- | ------------------------------------------------------------ |
| Python | eTree / lxml parser | Python-flask-xxe | By default, the attribute "no_network" that is set is True. Although local file read is possible, this prevents XXE from doing SSRF attacks.<br /><br />See line 55 of app.py |
| PHP | DOM parser | Php-Haboob-xxe | By default, the parser does not allow entity expansion and disallow external DTD.<br /><br />See line 5 of xxe.php |
| Java | JAXB | Ja | By default, the parser does not allow external DTD access.<br /><br />See line 104 of XXEApp.java |

Lab Features

1. Portable En

The en was build containers which allows for easy set up, without having to worry about dependencies.

2. Incorporated an attacker's file hosting server

With the incorporated attacker file server, one can interactively shell in to drop files for the server to fetch.

3. Simulated AWS Metadata Instance

This can be used to demonstrate the impact of Ser Request Forgery (SSRF) via XXE to steal cloud credentials.

Quick Start

1. Install docker.
2. Install docker compose.
3. Clone the repository:
git clone
4. Visit respective Apps directory of interest and run:
./start.sh
5. To stop the respective apps, run the ./stop.sh.

!Set up example

Intro

What is XXE?

Definition by OWASP

> *XML External Entity* attack is a type of attack against an application that parses XML input. This attack occurs when XML input containing a reference to an external entity is processed by a <u>weakly configured</u> XML parser. This attack may lead to the disclosure of confidential data, denial of service, server side request forgery, port scanning from the perspective of the machine where the parser is located, and other system impacts.

source: )_Processing

Why study XXE?

1. Ranked #4 in OWASP top 10.

source:

2. Ranked #15 as one of the most impactful reported on HackerOne Bug Bounty Platform.

source:

3. XXE's impact can be related to another impactful well-known , Ser Request Forgery (SSRF).

Some Impact of XXE

The following impacts can be demonstrated in the XXE lab set up and some examples have been provided in their respective example folders.

1. Arbitrary File Read
1. Data ex-filtration of source codes / configuration files.
2. Ser Request Forgery
1. Exposure of internal services.
2. Enumeration of internal services via "Port scanning".
3. Stealing of cloud credentials instances.
3. Denial-of-service

Other Possible Impacts (Parser specifics)

1. Directory listing ( applicable only for Java SAX parser )
2. Remote code execution (applicable only for PHP/expects or ASP)

XML Essentials

Document type definition (DTD)

What is a DTD?

> A DTD defines the valid <u>building blocks</u> of an XML document. It defines the document structure with a <u>list of elements and attributes</u>

source:

Syntax

Note: It has to be defined before any XML document node begin. This means that when exploiting XXE, we cannot inject a DTD in the middle of an XML body. The syntax is also case-sensitive.

Usage of the abo in the body:

ENTITY

1. Internal Entity

Definition:

Usage:

Output:

2. External Entity

Definition:

Usage:

include.xml:

Output:

3. Parameter Entity

This particular entity is confusing. You may think of this as an entity whose value defines another definition.

1. Internal definition

Definition:

Usage:

Parameter entities are used exclusively within DTDs. They cannot be used directly within XML body.

The abo would expand to the following during run-time:

2 different usages within the document:

Output:

2. External definition

Supposed an application configured a WAF to disallow "/etc/passwd" to be sent to the server, the attacker can avoid using "/etc/passwd" in his request by defining entities outside of the injected XML to be included during run-time.

External DTD file:

Definition:

The abo would fetch the definition of "callme" from an external ser run-time to be expanded in the following form:

call from original XML:

3. Internal Subset problem

Supposed a de would like to wrap around a parameter entity as follows:

The abo face an error *"XMLSyntaxError: PEReferences forbidden in internal subset"*.

In order to use a parameter entity in an entity's value, an external entity has to be used.

external.dtd:

document.xml:

Output:

4. First match matters

Given the following definition and body:

Output:

When an entity is defined more than once, the XML parser will assume the first match and drop the remaining.

Limitations on Data Ex-filtration

XXE File content disclosure has some limitations in type of files that can be disclosed. If a file content contains any of illegal bad characters, the content has a <u>high likelihood</u> of not being retrievable. In such cases, the attacker would need to rely on techniques to encode the content before retrieval. The following characters were collected after some fuzzing.

Illegal characters

In the case of "<", this is due to parser scanning for the start of an XML node. If the content does not form a proper XML node, the parser would raise exceptions like "*lxml.etree._raiseParseError XMLSyntaxError: chunk is not well balanced*". A well-form XML <test></test> would not face such error.

In the case of "&", this is due to parser scanning for an entity's name. Without a proper entity syntax, the parser would raise exceptions like "*lxml.etree._raiseParseError XMLSyntaxError: xmlParseEntityRef: no name*". A well-formed XML entity syntax like > would not face such error.

All safe characters

Supposed there is a file illegal.txt that contains some illegal character:

Performing the following attack to directly retrieve that file would result in error:

So how can we retrie with illegal characters like "<" and "&" ?

Enters CDATA

Character Data (CDATA) can be used to surround illegal characters to prevent XML parser from parsing them.

if the file content can be surround by <![CDATA[ and ]]> , the file content can be retrievable.

This requires a wrapper and the knowledge of the Internal Subset Problem comes to our rescue.

We can use an external *readillegal.dtd* file with CDATA wrapper being <u>html-entity encoded</u>:

Injected definition & body:

Output:

We can successfully read a file with illegal characters. You may try this out with Python-flask-xxe app that will throw you error messages.

However, if the length of the file with illegal characters is too large, XML parser will attempt to throw *"XMLSyntaxError: Detected an entity reference loop"* as it attempts to stop billion laughter attacks. This can be seen when attempting to steal the source code of app.py.

Directory Listing

In certain parsers such as Java's SAX JAXB parser, it is possible to perform directory listing. This can be demonstrated via our provided Java lab container.

PHP Wrappers

The PHP language allows stealing of file content regardless whether they contains illegal characters. This is unique to PHP alone.

PHP has a pseudo url "php://" that when invoked by PHP programs, can be abused to do base64 encoding of a resource before sending to output stream.

RCE via PHP expect module

The PECL's "expect" external module is often used to automate interacti. Some example use cases are to handle interacti like ssh / ftp over PHP. This allows command injection via the "expect://" pseudo url. However, this module is not installed along with the default PHP server but a custom add-on plugin added by de.

You may try out with the PHP lab container where the 'expect' module has been installed.

Data Ex-filtration XXE (OOBXXE)

The previous techniques of reading files depends on the immediate response. This type of XXE is known as in-band XXE. Further complications arise when the server does not reflect the content directly in the immediate response. This type of scenario requires Out-of-Band XXE techniques, where the content are sent over to the attacker channels such as DNS / HTTP / FTP / etc.

Stealing all types of files

With PHP wrappers to encode file contents to base64, we can steal all types of file even when the content is not reflected in the immediate response. It is necessary to use an external DTD file to prevent the internal subset problem mentioned earlier.

oob.dtd:

Injected definition and body;

Attacker's HTTP log:

The content of /etc/hostname ex-filtrated in this case was 41dd2e9fdb08 .

OOB illegal characters

By using protocols like HTTP, an additional layer of protocol has their own illegal characters. For example, HTTP relies on "\r\n" as delimiter to distinguish HTTP headers.

As such, non-encoded file content with characters like newlines cannot be successfully ex-filtrated without any form of encoding to remove such characters. As such, the impact of OOB data ex-filtration for non-PHP is often limited.

Great Works by Others

Useful Tools

1. A con website to enter your domain name and generates a OOB XXE PoC.
2. staaldraad/xxeserv: Simplifies setting up of FTP Server to receive OOB XXE via FTP. See usage here.
3. RequestBins: A con website to capture DNS queries / HTTP requests from server.
4. Ngrok: A tool to generate temporary domain and forward TCP connections to local machine.

More Open-source Labs

1. c0ny1/xxe-lab: A similar repository in chinese.
2. jbarone/xxelab: PHP application with python XXE shell

More Closed-source Labs

1. PortSwigger/XXE: Free PortSwigger labs that features XXE (requires sign in).

Some Blogs on XXE

1. DepthSecurity: Exploitation: Exploitation technique for PHP web.
2. SYNACK: Deep Dive: This blog included attack scenario on PHP Expect module & Pass the SOAP.
3. INFOSEC: XML still attractive: This blog included python lxml recommendation.
4. ambb1: XXE Summary: A chinese blog that attempts to summarise XXE.
5. Christian Mainka: Detecting and exploiting XXE in SAML Interfaces: Additional settings in Java to prevent XXE and more on SAML XXE.
6. scriptkidd1e: C: Openoffice XML (OOXML) attack on outdated Apache Tika 1.12
7. Airman: XXE to RCE with PHP/expect: XXE to RCE with "expect" module.
8. Andy Gill: XXE - Things Are Getting Out of Band: OOB XXE for java 1.7 and RCE with ASP
9. Hackwithpassion: XXE in Golang are surprisingly hard: Golang's default XML libraries are not subceptible to XXE.
10. From blind XXE to root-level file read access: Article highlights Java SAX's XXE directory listing capability, bypassing of firewall with internal proxy route and error-based XXE URL.
11. From XXE to RCE: Pwn2Win CTF 2018 Writeup: A CTF writeup that made use of Content-Type manipulation to force Json -> xml data and how to use gopher to craft HTTP request.

Payload Cheatsheets

1. PayloadsAllTheThings/XXE Injection: List of community payloads to experiment on.
2. staaldraad/XXE\_payloads: More payloads examples
3. Christian Mainka: XXE cheat sheet: 2016 cheatsheet on XXE.

项目信息

开发语言：PHP

Star 数：116

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕This repository contains various XXE labs set up for different languages and their different parsers. This may alternatively serve as a playground to teach or test with Vulnerability scanners / WAF rules / Secure Configuration settings.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。