Instructor: XML vulnerabilities. 2 2
In this lesson we're going to talk about XML, 3 3
which is the eXtensible Markup Language. 4 4
This is used by web applications 5 5
for authentication and authorizations 6 6
and for other types of data exchange and uploading. 7 7
Now, here you might hear some people talk about this 8 8
as XML vulnerabilities, XML exploitation, 9 9
or even XML injection. 10 10
Now, technically XML injection isn't really accurate. 11 11
It's more of an XML parsing vulnerability 12 12
that people are exploiting, 13 13
but on the exam you may see it called 14 14
any of those three things. 15 15
Now, when we talk about XML data, the XML data itself 16 16
has to be submitted from you to the server 17 17
or from one server to another, 18 18
and so when you're dealing with XML data, 19 19
you want to make sure that it's submitted 20 20
with encryption or input validation. 21 21
If you submit XML data without encryption 22 22
or without input validation, 23 23
it's going to be vulnerable to spoofing, request forgery, 24 24
and injection of arbitrary code, 25 25
so we want to make sure we prevent that. 26 26
Again, input validation is here to help 27 27
and so is encryption. 28 28
Now, when you look at XML, it looks something like this. 29 29
This is a basic XML that I set up 30 30
just to show you the example of it. 31 31
You'll notice the first line here. 32 32
It has XML listed right in there. 33 33
What version of XML and what type of encoding we're using. 34 34
The second line. This is what we're defining. 35 35
We're defining a question in this case. 36 36
And then we have a couple of different fields 37 37
inside this question type. 38 38
For instance, I have the id. 39 39
In this case, I'm identifying it as CYSA-002-0001. 40 40
It's the first question 41 41
in the second version of the CYSA+ exam. 42 42
Then I have a title, Is this an XML vulnerability? 43 43
And then I have a choice, Yes, and a second choice, No. 44 44
You can define these with any kind of terms you want. 45 45
This is just how I define the structure for my question 46 46
because maybe I have a quiz app 47 47
and it's going to read this information 48 48
and display it to the screen 49 49
so you can get different questions 50 50
while you're practicing for your CYSA exam. 51 51
And then you'll see they all, just like HTML, 52 52
have the slash at the end of them 53 53
closing out those brackets and closing out the XML. 54 54
If you see something like this, 55 55
I want you to recognize it as XML code. 56 56
Now, the next thing we're going to talk about 57 57
is some of the exploits that we can have with XML. 58 58
Now, the first one we're going to talk about 59 59
is an XML bomb or a billion laughs attack. 60 60
Now, this is where they take XML and they use this encoding 61 61
to encode those entities that I just showed you 62 62
and expand them to exponential sizes 63 63
consuming memory on the host and potentially crashing it. 64 64
So what does this sound like to you? 65 65
Well, it sounds like a bomb or a denial of service attack. 66 66
If I can go forward and I can start consuming 67 67
all these resources on your web server 68 68
by uploading some kind of bad XML file, 69 69
I can take you down, 70 70
and that's what we're trying to do with an XML bomb. 71 71
Now, the next one we're going to talk about 72 72
is an XML external entity, or XXE. 73 73
Now, this is an attack that embeds a request 74 74
for a local resource. 75 75
Hmm, this sounds kind of like a file inclusion, doesn't it? 76 76
Well, let's take a look at what this looks like. 77 77
Well, if we have something like XML, 78 78
it's going to look like this, 79 79
and we're going to have XML, the version, 80 80
and the encoding type. 81 81
Then we have the document type. 82 82
We're defining this as foo, 83 83
which is just coder speak for some junk variable. 84 84
Then we have the element foo ANY, 85 85
we have the entity XXE SYSTEM, 86 86
and then we have that file, file:///etc/shadow, 87 87
and then we end this out with some kind of data type in XML. 88 88
In this case, we're calling it foo 89 89
instead of question, or title, or id. 90 90
So what really are we looking for in here 91 91
that's really looking bad? 92 92
Well, that XXE shadow file, right? 93 93
By looking at that file:///etc/shadow, 94 94
that tells me they're trying to do a file inclusion. 95 95
And because they're doing it through XML, 96 96
this is known as an XML external entity 97 97
or XXE type of attack. 98 98
Now, to prevent XML vulnerabilities from being exploited, 99 99
what do you think you want to do? 100 100
You want to use proper input validation. That's right. 101 101
Input validation, input validation, input validation. 102 102
We keep talking about it, but it's really that important. 103 103
Are we sensing a theme here? 104 104
If we validate the input from a user, 105 105
whether it's a URL being inputted, a file being inputted, 106 106
a field being entered on a website, 107 107
we can prevent a lot of these security issues. 108 108
So always remember input validation 109 109
anytime the user's giving you something 110 110
and that'll help prevent a lot of these different attacks. 111 111
Now, for the exam, 112 112
if you see something with XML written in it 113 113
and it is clearly XML, guess what? 114 114
It's going to be an XML vulnerability that's being exploited. 115 115
They might call this XML vulnerability. 116 116
They might call it XML exploitation. 117 117
They might call it XML injection. 118 118
Whatever they're talking about, 119 119
it's still an XML vulnerability that's being exploited here. 120 120
Now, if you see anything 121 121
that looks like the code in the format 122 122
that I showed you in this lesson, guess what? 123 123
It's probably XML. 124 124
Now, the only tricky part with this 125 125
is that XML code can often look a lot like HTML code 126 126
or it might look like JavaScript. 127 127
The big difference is that when you're dealing 128 128
with HTML or JavaScript, there are defined keywords 129 129
for each of those bracketed entries. 130 130
With XML, you can make those say anything you want 131 131
depending on how you're configuring your XML. 132 132
So just take a second to read the code and identify. 133 133
Does this look like HTML? 134 134
Are they using something like font, or image, or attr? 135 135
That's HTML. 136 136
If they're using something like question, or ID, or type, 137 137
or element, or entity, that's XML. 138 138
And so this will help you figure out 139 139
which one they're referring to 140 140
so you can get the right answer.