Exploiting XXEs

Let's now look at another type of vulnerability that we may come across while performing a pentest. XML External Entity (XEE) attacks are a type of attack against an application that parses XML input poorly. These types of attacks can lead to local file disclosure such as password files. It can also be used to pivot to other internal systems in the network using RCE.

How to do it...

Let's see an example of a vulnerable application and how it can be exploited using XXE:

1. The following is an application that sends an XML post request to the server upon clicking the button titled Any bugs? as shown in the following screenshot:

2. The following request is being sent to the server:

3. We now submit a random...