From the course: Penetration Testing Web Apps with Kali and Burp Suite

Unlock the full course today

Join today to access over 24,900 courses taught by industry experts.

Injecting XML into a web page

Injecting XML into a web page

From the course: Penetration Testing Web Apps with Kali and Burp Suite

Start my 1-month free trial Buy for my team

Injecting XML into a web page

“

- XML is another technology which is used in webpages. If we can inject XML, then we may be able to use it to gain access to data. Let's see how we might inject some code into a server via an XML input field. For this testing, we'll use Mutillidae. We'll select XML external entities and open the XML validator page. And let's enter message "hello folks" and validate that. And this validates and we can see the message displayed. Let's exploit this webpage. We can input a slightly more complex XML construct. to access the contents of a file. In this case, we'll check the contents of /et cetera/ password and we'll do that with shriek doc type. And we'll give it to name, and shriek entity and we'll just call it F as a variable and system. And the system entity we want is the file /// et cetera / password. And we'll put out the message with the contents of that, and validate that. And we can see the contents of…

Contents