1. Lesser Known Injections XML Injections AMol NAik

2. About me Web Application PentesterCore member of Garage4HackersBounty Hunter in pastCurrently fuzzing browsers for Fun & Profit

3. Garage4Hackers Family of 3,800, posts 8k+40+ best Bug Bounty submissions15+ browser bugs in Chrome, IE, FF & SafariASLR bypass method presented at CanSecWest was already shared on G4H forum5+ Information Security Research (cable TV & Datacard)10+ Tools & scripts, 1+ Web application CTFRanchhoddas Webcast Series – 5+ webinarsFollow us on Twitter @garage4hackers

4. Agenda XML BasicXML InjectionXXE AttackXPath BasicsXPath Injections

5. XXE is a the new SQL Injection - Someone on Twitter

6. XML Injection in Real-World Yandex pwned for $5000 with XXE by @d0znppOpenID XXE by Reginaldo SilvaMultiple XXE bugs by @Securatary teamXXE in Google Toolbar by Detectify team - $10k

7. XML Basics

8. eXtensible Markup LanguageFlexible text- based formatPresents structured infoUsed for Data Exchange/Storage

9. XML Components

10. XML – CDATA Section Tells parser not to use markup for characters in this sectionExamples:

11. XML Injections

12. Injection Points

13. XML Injection – Node Attribute

15. XML Injection – Node Value

17. XML Injection – CDATA Section

19. XXE Attack

20. XML Entity VariableDefine Can be Internal/External

21. XML Entity

22. XXE Attack

23. XPath Basics Language to select XML NodesFormats XML data as tree-structured valuesSimilar as SQL (in some sense)

24. XPath Syntax Uses path expressions to select nodes or node-sets in an xml document ExpressionDescription nodenameSelects all child nodes of the named node /Selects from root node //Selects nodes from the current node that match the selection no matter where they are.Selects current node..Selects parent of the current node

25. XPath Predicates Used to find a specific node or a node that contain specific value.Always embedded in square brackets

26. XPath Predicates ExpressionResult /Employees/Employee[1]Selects first ‘Employee’ element that is the child of ‘Employees’ element /Employees/Employee[last()]Selects last ‘Employee’ element that is the child of ‘Employees’ element /Employees/Employee[position()<3]Selects first 2 ‘Employee’ elements that are children of Employees element //Employee[@ID=‘1’]Selects all the ‘Employee’ elements that have an attribute named ‘ID’ with a value of ‘1’

27. XPath Location Path Syntax: axisname::nodetest[predicate]

28. XPath Location Path ExampleResult child::EmployeeSelects all ‘Employee’ node that are children of the current node attribute::idSelects the id attribute of the current node child::*Selects all children of the current node attribute::*Selects all attributes of the current node child::text()Selects all text child nodes of the current node child::node()Selects all child nodes of the current node descendant::EmployeesSelects all ‘Employees’ descendants of the current node

29. XPath Injection XPath Query: /Employees/Employee[UserName/text() = ‘user’ and Password/text() = ‘passwd’]/Type/text()

30. XPath Injection No UserName & Password known:

31. XPath Injection UserName known: /Employees/Employee[UserName/text() = ‘mbrown’ or ‘1’=‘1’ and Password/text() = ‘anything’]Type/text()

32. XPath Injection No UserName & Password known & Password is not vulnerable:

33. Conclusion XML Injections are ignoredMany sites having these issues

34. That's It !! AMol NAik @amolnaik4 mailto: amolnaik4@garage4hackers.com

35. References XPath InjectionHacking XPath 2.0Blind XPath Injection