XXE Attack Alternatives

TL;DR

If direct XXE attacks are blocked, explore alternative paths like external entity resolution with local files, internal network interaction, and blind XXE techniques. Focus on identifying accessible resources and exploiting XML parsers’ features.

1. Understand the Blockage

Before trying alternatives, confirm how XXE is blocked. Common methods include:

• Input Validation: Filtering characters like <, >, and &.
• XML Parser Configuration: Disabling external entities or DTD processing.
• Web Application Firewall (WAF): Rules detecting XXE patterns.

Knowing the block will guide your next steps.

2. Local File Inclusion via External Entities

If external entity resolution is allowed for local files, you can read sensitive data:

1. Craft a malicious XML payload:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [<entity name="xxe" value="file:///etc/passwd"/>]
<root>&xxe;

2. Send the payload to the application.
3. Check the response: If successful, you’ll see the contents of /etc/passwd (or another file).

Note: The exact path format may vary depending on the operating system and XML parser.

3. Internal Network Interaction

If the application server has access to an internal network, you can attempt to read files from other servers:

1. Identify accessible internal resources: Use techniques like port scanning or information gathering.
2. Modify the external entity definition: Point it to an internal resource.

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [<entity name="xxe" value="http://internal-server/sensitive_data.txt"/>]
<root>&xxe;

3. Send the payload and check the response.

Firewall rules on the internal network may prevent this.

4. Blind XXE Exploitation

If you don’t see the file contents directly, try blind XXE:

• Time-based Blind XXE: Use a delay to confirm if an entity is resolved.

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [<entity name="xxe" value="file:///etc/passwd"/>]
<root>&xxe;

• Error-based Blind XXE: Trigger XML parser errors based on entity resolution.

Blind XXE requires more patience and analysis of server responses.

5. DTD vs. External Entities

If external entities are blocked, try using a Document Type Definition (DTD) to define the entities:

1. Craft a malicious XML payload with a DTD:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [<entity name="xxe" value="file:///etc/passwd"/>]
<root>&xxe;

2. Send the payload and check the response.

Some parsers may block DTDs as well.

6. XML External Parameter Entity (XEP) Injection

This is a more general term for XXE, but it’s worth noting that different parsers handle XEP differently. Experiment with variations of the payload and entity definitions.

7. Consider Server-Side Request Forgery (SSRF)

XXE can sometimes be chained with SSRF if the application allows external entities to interact with internal URLs. This is a more advanced technique but can lead to significant vulnerabilities.