Exploiting an XML External Entity Injection
XML (Extensible Markup Language) is a format that is mainly used to describe the structure of documents or data; HTML, for example, is an implementation of XML which defines structure and format of pages and relations among them.
XML entities are similar to data structures that are defined inside an XML structure and some of them have the ability to read files from the system or even execute commands.
In this recipe, we will exploit an XML External Entity (XEE) Injection vulnerability to reach code execution in the server.
Getting ready
It is suggested that you follow the Abusing file inclusions and uploads recipe before doing this.
How to do it...
- Browse to
http://192.168.56.102/mutillidae/index.php?page=xml-validator.php ...
Get Kali Linux Web Penetration Testing Cookbook now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
