4.0

135
Web Application Penetration Testing
is well formed and valid, and represents the ‘’
inside a text node, a CDATA section may be used:
]]>
so that ‘’ won’t be parsed as markup and will be considered
as character data.
If a node is built in the following way:
the tester could try to inject the end CDATA string ‘]]>’ in order to
try to invalidate the XML document.
userName = ]]>
this will become:
]]>
which is not a valid XML fragment.
Another test is related to CDATA tag. Suppose that the XML document
is processed to generate an HTML page. In this case, the
CDATA section delimiters may be simply eliminated, without further
inspecting their contents. Then, it is possible to inject HTML
tags, which will be included in the generated page, completely bypassing
existing sanitization routines.
Let’s consider a concrete example. Suppose we have a node containing
some text that will be displayed back to the user.
$HTMLCode
Then, an attacker can provide the following input:
$HTMLCode = script]]>alert(‘xss’)/script]]>
and obtain the following node:
script]]>alert(‘xss’)/
script]]>
During the processing, the CDATA section delimiters are eliminated,
generating the following HTML code:
alert(‘XSS’)
The result is that the application is vulnerable to XSS.
External Entity:
The set of valid entities can be extended by defining new entities.
If the definition of an entity is a URI, the entity is called an external
entity. Unless configured to do otherwise, external entities force
the XML parser to access the resource specified by the URI, e.g.,
a file on the local machine or on a remote systems. This behavior
exposes the application to XML eXternal Entity (XXE) attacks,
which can be used to perform denial of service of the local system,
gain unauthorized access to files on the local machine, scan remote
machines, and perform denial of service of remote systems.
To test for XXE vulnerabilities, one can use the following input:
]>&xxe;
This test could crash the web server (on a UNIX system), if the
XML parser attempts to substitute the entity with the contents of
the /dev/random file.
Other useful tests are the following:
]>&xxe;