XXE Injection 1 | Exploiting XXE Using External Entities to Retrieve Files #BugBounty

Summary

This educational video from HM Cyber Academy explains XML External Entity (XXE) injection and demonstrates a hands-on lab. The presenter defines XML and contrasts it with JSON, then identifies a vulnerable "Check Stock" feature that accepts XML input. Using Burp Suite and Repeater, they show how to craft a DOCTYPE with an external entity that points to the server file /etc/passwd and how to reference that entity (e.g., in <productId>&hm;</productId>) to force disclosure. The video highlights common syntax pitfalls (case sensitivity, missing semicolon) and walks through solving the lab, emphasizing safe, ethical testing.

Takeaways

• 😀 XXE stands for XML External Entity and is a type of XML injection vulnerability.
• 🔍 XML (Extensible Markup Language) is a common data format used for client–server data exchange, alongside JSON.
• 🧪 The video demonstrates a lab exercise exploiting an XXE vulnerability in a "check stock" XML endpoint.
• 🧭 The goal of the lab is to inject an external entity to retrieve the server file `/etc/passwd`.
• 🛠️ Burp Suite (Proxy & Repeater) is used to capture, modify, and resend the XML requests to test the endpoint.
• 📡 Observing a partial page update (only the stock value) indicates the site is returning structured data rather than full HTML.
• 📜 The exploit requires declaring a DOCTYPE with an external ENTITY that references a local file (e.g., `file:///etc/passwd`).
• ⚠️ After declaring an entity you must call it in the XML body (including the trailing semicolon) — forgetting to call it or missing semicolons are common beginner mistakes.
• 🔤 XML is case-sensitive, so entity names and tags must match exactly between declaration and usage.
• ✅ A successful XXE can return file contents in the server response (the video shows `/etc/passwd` appearing after exploitation).
• 🧾 Syntax accuracy is critical for XXE payloads — small typos or missing characters prevent exploitation.
• 🔒 Defensive takeaway: validate or disable external entity processing in XML parsers to prevent XXE (implied by the exploit demonstration).

Q & A

What is XXE (XML External Entity) injection?

XXE injection is a type of attack where malicious XML input is used to exploit a vulnerable XML parser, allowing an attacker to interact with internal files and services of a web server.

What is XML, and how does it relate to web data exchange?

XML (Extensible Markup Language) is a format for structuring data that can be transmitted between a client and a server, similar to JSON. It is used to send data in a structured, readable format.

What are the two common formats used for data exchange between the client and the server?

The two most common formats for data exchange are XML and JSON (JavaScript Object Notation).

How does XML External Entity (XXE) injection exploit vulnerabilities in a server?

XXE injection exploits vulnerabilities in the way XML parsers process external entities. By injecting malicious XML containing references to internal files (like /etc/passwd), an attacker can gain access to sensitive data stored on the server.

What is the purpose of the 'check stock' feature in the lab environment?

The 'check stock' feature allows the user to query the number of units of a product available in stock. It processes XML or JSON requests and returns data based on the request, making it a potential target for XXE injection.

In the lab exercise, what file does the attacker aim to retrieve through the XXE injection?

In the lab exercise, the attacker aims to retrieve the contents of the '/etc/passwd' file, which contains sensitive information about the server's users.

What is the significance of the payload used in the XXE injection demonstration?

The payload is crafted to define an external entity that points to the '/etc/passwd' file on the server. By calling this entity within the XML structure, the attacker can retrieve sensitive file data.

Why is the correct syntax crucial when performing an XXE injection?

Correct syntax is crucial in XXE injection because XML is case-sensitive, and failure to use the right format or structure can prevent the payload from executing successfully.

What common mistake did the presenter mention making during the initial attempts at XXE injection?

The presenter mentioned forgetting to include the semicolon in the payload, which is essential for correctly referencing the defined entity in XML.

How does the 'stock check' feature respond to the successful XXE injection?

Upon successful XXE injection, the 'stock check' feature returns an 'invalid product ID' message, but it also reveals the contents of the '/etc/passwd' file in the response body.