This lesson covers a vulnerability with an unusual property: the damage is done by the parser, not by the application code that reads the parsed value. The application does not have to do anything with the parsed data for the attack to succeed.
XML External Entities (XXE) is the case where the parser is an XML parser and the attacker's payload is an XML document that declares an external entity. A default parser dereferences the entity at parse time and reads a file, makes an HTTP request, or worse, on the attacker's behalf.
Scope reminder: perform XXE testing only against systems you own or are explicitly authorized to test. The bundled NovaCart application instance is the authorized lab target for this lesson.
In this lesson you will:
- Inspect NovaCart's complaint form (which you also used in the SSRF and file-upload lesson) and reason about whether it accepts XML uploads.
- Construct an XXE payload that reads a local file through an external entity reference.
- Submit the XML document through the complaint form and observe the server's response (or its absence).
Estimated time: fifteen to twenty minutes.
Prerequisites: ssrf-file-upload for the complaint form and the server-side reachability model, data-representation-fundamentals for structured formats, and intercepting-proxies or browser-recon for observing multipart requests.
When you are ready, send the Continue signal.