1BO4r2U

131 132
Web Application Penetration Testing
Web Application Penetration Testing
Testing for XML Injection (OTG-INPVAL-008)
Summary
XML Injection testing is when a tester tries to inject an XML doc to the
application. If the XML parser fails to contextually validate data, then
the test will yield a positive result.
This section describes practical examples of XML Injection. First, an
XML style communication will be defined and its working principles
explained. Then, the discovery method in which we try to insert XML
metacharacters. Once the first step is accomplished, the tester will
have some information about the XML structure, so it will be possible
to try to inject XML data and tags (Tag Injection).
How to Test
Let’s suppose there is a web application using an XML style communication
in order to perform user registration. This is done by creating
and adding a new node in an xmlDb file.
Let’s suppose the xmlDB file is like the following:
gandalf
!c3
0
gandalf@middleearth.com
Stefan0
w1s3c
500
Stefan0@whysec.hmm
When a user registers himself by filling an HTML form, the application
receives the user’s data in a standard request, which, for the sake of
simplicity, will be supposed to be sent as a GET request.
For example, the following values:
Username: tony
Password: Un6R34kb!e
E-mail: s4tan@hell.com
will produce the request:
http:/www.example.com/addUser.php?username=tony&password=Un6R34kb!e&email=s4tan@hell.com
The application, then, builds the following node:
which will be added to the xmlDB:
Discovery
The first step in order to test an application for the presence of a XML
Injection vulnerability consists of trying to insert XML metacharacters.
XML metacharacters are:
• Single quote: ‘ - When not sanitized, this character could throw an
exception during XML parsing, if the injected value is going to be part
of an attribute value in a tag.
As an example, let’s suppose there is the following attribute
So, if:
tony
Un6R34kb!e
500
s4tan@hell.com
gandalf
!c3
0
gandalf@middleearth.com
Stefan0
w1s3c
500
Stefan0@whysec.hmm
tony
Un6R34kb!e
500
s4tan@hell.com
inputValue = foo’
is instantiated and then is inserted as the attrib value:
then, the resulting XML document is not well formed.
• Double quote: “ - this character has the same meaning as single
quote and it could be used if the attribute value is enclosed in double
quotes.
So if:
$inputValue = foo”
the substitution gives:
and the resulting XML document is invalid.
• Angular parentheses: > and < - By adding an open or closed angular
parenthesis in a user input like the following:
Username = foo<
the application will build a new node:
foo