1 1 00:00:00,420 --> 00:00:02,340 XML vulnerabilities. 2 2 00:00:02,340 --> 00:00:04,950 In this lesson we're going to talk about XML, 3 3 00:00:04,950 --> 00:00:07,350 which is the eXtensible Markup Language. 4 4 00:00:07,350 --> 00:00:08,880 This is used by web applications 5 5 00:00:08,880 --> 00:00:10,710 for authentication and authorizations 6 6 00:00:10,710 --> 00:00:13,500 and for other types of data exchange and uploading. 7 7 00:00:13,500 --> 00:00:15,690 Now, here you might hear some people talk about this 8 8 00:00:15,690 --> 00:00:18,720 as XML vulnerabilities, XML exploitation, 9 9 00:00:18,720 --> 00:00:20,670 or even XML injection. 10 10 00:00:20,670 --> 00:00:23,820 Now, technically XML injection isn't really accurate. 11 11 00:00:23,820 --> 00:00:26,010 It's more of an XML parsing vulnerability 12 12 00:00:26,010 --> 00:00:27,240 that people are exploiting, 13 13 00:00:27,240 --> 00:00:29,010 but on the exam you may see it called 14 14 00:00:29,010 --> 00:00:30,780 any of those three things. 15 15 00:00:30,780 --> 00:00:33,840 Now, when we talk about XML data, the XML data itself 16 16 00:00:33,840 --> 00:00:36,720 has to be submitted from you to the server 17 17 00:00:36,720 --> 00:00:38,550 or from one server to another, 18 18 00:00:38,550 --> 00:00:40,290 and so when you're dealing with XML data, 19 19 00:00:40,290 --> 00:00:41,520 you want to make sure that it's submitted 20 20 00:00:41,520 --> 00:00:43,710 with encryption or input validation. 21 21 00:00:43,710 --> 00:00:45,870 If you submit XML data without encryption 22 22 00:00:45,870 --> 00:00:47,550 or without input validation, 23 23 00:00:47,550 --> 00:00:50,160 it's going to be vulnerable to spoofing, request forgery, 24 24 00:00:50,160 --> 00:00:52,050 and injection of arbitrary code, 25 25 00:00:52,050 --> 00:00:53,880 so we want to make sure we prevent that. 26 26 00:00:53,880 --> 00:00:56,310 Again, input validation is here to help 27 27 00:00:56,310 --> 00:00:57,870 and so is encryption. 28 28 00:00:57,870 --> 00:01:00,720 Now, when you look at XML, it looks something like this. 29 29 00:01:00,720 --> 00:01:02,910 This is a basic XML that I set up 30 30 00:01:02,910 --> 00:01:04,470 just to show you the example of it. 31 31 00:01:04,470 --> 00:01:05,880 You'll notice the first line here. 32 32 00:01:05,880 --> 00:01:07,860 It has XML listed right in there. 33 33 00:01:07,860 --> 00:01:11,310 What version of XML and what type of encoding we're using. 34 34 00:01:11,310 --> 00:01:13,440 The second line. This is what we're defining. 35 35 00:01:13,440 --> 00:01:15,750 We're defining a question in this case. 36 36 00:01:15,750 --> 00:01:17,640 And then we have a couple of different fields 37 37 00:01:17,640 --> 00:01:19,410 inside this question type. 38 38 00:01:19,410 --> 00:01:20,880 For instance, I have the id. 39 39 00:01:20,880 --> 00:01:25,290 In this case, I'm identifying it as CYSA-002-0001. 40 40 00:01:26,280 --> 00:01:27,570 It's the first question 41 41 00:01:27,570 --> 00:01:30,510 in the second version of the CYSA+ exam. 42 42 00:01:30,510 --> 00:01:33,540 Then I have a title, Is this an XML vulnerability? 43 43 00:01:33,540 --> 00:01:36,900 And then I have a choice, Yes, and a second choice, No. 44 44 00:01:36,900 --> 00:01:39,330 You can define these with any kind of terms you want. 45 45 00:01:39,330 --> 00:01:42,210 This is just how I define the structure for my question 46 46 00:01:42,210 --> 00:01:43,500 because maybe I have a quiz app 47 47 00:01:43,500 --> 00:01:44,850 and it's going to read this information 48 48 00:01:44,850 --> 00:01:46,140 and display it to the screen 49 49 00:01:46,140 --> 00:01:47,550 so you can get different questions 50 50 00:01:47,550 --> 00:01:50,040 while you're practicing for your CYSA exam. 51 51 00:01:50,040 --> 00:01:51,960 And then you'll see they all, just like HTML, 52 52 00:01:51,960 --> 00:01:53,730 have the slash at the end of them 53 53 00:01:53,730 --> 00:01:56,450 closing out those brackets and closing out the XML. 54 54 00:01:56,450 --> 00:01:57,750 If you see something like this, 55 55 00:01:57,750 --> 00:02:00,720 I want you to recognize it as XML code. 56 56 00:02:00,720 --> 00:02:02,010 Now, the next thing we're going to talk about 57 57 00:02:02,010 --> 00:02:04,500 is some of the exploits that we can have with XML. 58 58 00:02:04,500 --> 00:02:05,700 Now, the first one we're going to talk about 59 59 00:02:05,700 --> 00:02:08,850 is an XML bomb or a billion laughs attack. 60 60 00:02:08,850 --> 00:02:12,060 Now, this is where they take XML and they use this encoding 61 61 00:02:12,060 --> 00:02:14,160 to encode those entities that I just showed you 62 62 00:02:14,160 --> 00:02:16,320 and expand them to exponential sizes 63 63 00:02:16,320 --> 00:02:19,200 consuming memory on the host and potentially crashing it. 64 64 00:02:19,200 --> 00:02:20,640 So what does this sound like to you? 65 65 00:02:20,640 --> 00:02:23,970 Well, it sounds like a bomb or a denial of service attack. 66 66 00:02:23,970 --> 00:02:26,070 If I can go forward and I can start consuming 67 67 00:02:26,070 --> 00:02:27,600 all these resources on your web server 68 68 00:02:27,600 --> 00:02:30,180 by uploading some kind of bad XML file, 69 69 00:02:30,180 --> 00:02:31,350 I can take you down, 70 70 00:02:31,350 --> 00:02:33,780 and that's what we're trying to do with an XML bomb. 71 71 00:02:33,780 --> 00:02:35,130 Now, the next one we're going to talk about 72 72 00:02:35,130 --> 00:02:38,850 is an XML external entity, or XXE. 73 73 00:02:38,850 --> 00:02:40,950 Now, this is an attack that embeds a request 74 74 00:02:40,950 --> 00:02:42,450 for a local resource. 75 75 00:02:42,450 --> 00:02:46,080 Hmm, this sounds kind of like a file inclusion, doesn't it? 76 76 00:02:46,080 --> 00:02:47,970 Well, let's take a look at what this looks like. 77 77 00:02:47,970 --> 00:02:50,010 Well, if we have something like XML, 78 78 00:02:50,010 --> 00:02:51,240 it's going to look like this, 79 79 00:02:51,240 --> 00:02:52,980 and we're going to have XML, the version, 80 80 00:02:52,980 --> 00:02:54,180 and the encoding type. 81 81 00:02:54,180 --> 00:02:55,650 Then we have the document type. 82 82 00:02:55,650 --> 00:02:57,060 We're defining this as foo, 83 83 00:02:57,060 --> 00:03:00,330 which is just coder speak for some junk variable. 84 84 00:03:00,330 --> 00:03:02,340 Then we have the element foo ANY, 85 85 00:03:02,340 --> 00:03:04,800 we have the entity XXE SYSTEM, 86 86 00:03:04,800 --> 00:03:09,800 and then we have that file, file:///etc/shadow, 87 87 00:03:10,140 --> 00:03:12,570 and then we end this out with some kind of data type in XML. 88 88 00:03:12,570 --> 00:03:13,980 In this case, we're calling it foo 89 89 00:03:13,980 --> 00:03:16,140 instead of question, or title, or id. 90 90 00:03:16,140 --> 00:03:17,730 So what really are we looking for in here 91 91 00:03:17,730 --> 00:03:19,050 that's really looking bad? 92 92 00:03:19,050 --> 00:03:21,210 Well, that XXE shadow file, right? 93 93 00:03:21,210 --> 00:03:24,510 By looking at that file:///etc/shadow, 94 94 00:03:24,510 --> 00:03:27,120 that tells me they're trying to do a file inclusion. 95 95 00:03:27,120 --> 00:03:28,950 And because they're doing it through XML, 96 96 00:03:28,950 --> 00:03:31,620 this is known as an XML external entity 97 97 00:03:31,620 --> 00:03:34,110 or XXE type of attack. 98 98 00:03:34,110 --> 00:03:37,050 Now, to prevent XML vulnerabilities from being exploited, 99 99 00:03:37,050 --> 00:03:38,790 what do you think you want to do? 100 100 00:03:38,790 --> 00:03:41,580 You want to use proper input validation. That's right. 101 101 00:03:41,580 --> 00:03:44,520 Input validation, input validation, input validation. 102 102 00:03:44,520 --> 00:03:47,340 We keep talking about it, but it's really that important. 103 103 00:03:47,340 --> 00:03:48,750 Are we sensing a theme here? 104 104 00:03:48,750 --> 00:03:50,910 If we validate the input from a user, 105 105 00:03:50,910 --> 00:03:53,940 whether it's a URL being inputted, a file being inputted, 106 106 00:03:53,940 --> 00:03:55,530 a field being entered on a website, 107 107 00:03:55,530 --> 00:03:58,170 we can prevent a lot of these security issues. 108 108 00:03:58,170 --> 00:04:00,270 So always remember input validation 109 109 00:04:00,270 --> 00:04:02,160 anytime the user's giving you something 110 110 00:04:02,160 --> 00:04:04,530 and that'll help prevent a lot of these different attacks. 111 111 00:04:04,530 --> 00:04:06,090 Now, for the exam, 112 112 00:04:06,090 --> 00:04:08,310 if you see something with XML written in it 113 113 00:04:08,310 --> 00:04:10,980 and it is clearly XML, guess what? 114 114 00:04:10,980 --> 00:04:13,650 It's going to be an XML vulnerability that's being exploited. 115 115 00:04:13,650 --> 00:04:15,630 They might call this XML vulnerability. 116 116 00:04:15,630 --> 00:04:17,610 They might call it XML exploitation. 117 117 00:04:17,610 --> 00:04:19,380 They might call it XML injection. 118 118 00:04:19,380 --> 00:04:20,400 Whatever they're talking about, 119 119 00:04:20,400 --> 00:04:23,400 it's still an XML vulnerability that's being exploited here. 120 120 00:04:23,400 --> 00:04:24,570 Now, if you see anything 121 121 00:04:24,570 --> 00:04:26,070 that looks like the code in the format 122 122 00:04:26,070 --> 00:04:28,410 that I showed you in this lesson, guess what? 123 123 00:04:28,410 --> 00:04:30,030 It's probably XML. 124 124 00:04:30,030 --> 00:04:31,560 Now, the only tricky part with this 125 125 00:04:31,560 --> 00:04:35,100 is that XML code can often look a lot like HTML code 126 126 00:04:35,100 --> 00:04:36,870 or it might look like JavaScript. 127 127 00:04:36,870 --> 00:04:38,310 The big difference is that when you're dealing 128 128 00:04:38,310 --> 00:04:40,860 with HTML or JavaScript, there are defined keywords 129 129 00:04:40,860 --> 00:04:42,660 for each of those bracketed entries. 130 130 00:04:42,660 --> 00:04:45,480 With XML, you can make those say anything you want 131 131 00:04:45,480 --> 00:04:47,580 depending on how you're configuring your XML. 132 132 00:04:47,580 --> 00:04:51,090 So just take a second to read the code and identify. 133 133 00:04:51,090 --> 00:04:52,620 Does this look like HTML? 134 134 00:04:52,620 --> 00:04:56,640 Are they using something like font, or image, or attr? 135 135 00:04:56,640 --> 00:04:57,930 That's HTML. 136 136 00:04:57,930 --> 00:05:00,660 If they're using something like question, or ID, or type, 137 137 00:05:00,660 --> 00:05:03,210 or element, or entity, that's XML. 138 138 00:05:03,210 --> 00:05:04,290 And so this will help you figure out 139 139 00:05:04,290 --> 00:05:05,370 which one they're referring to 140 140 00:05:05,370 --> 00:05:06,970 so you can get the right answer.