diff --git a/webgoat-lessons/xxe/src/main/java/org/owasp/webgoat/plugin/SimpleXXE.java b/webgoat-lessons/xxe/src/main/java/org/owasp/webgoat/plugin/SimpleXXE.java index 06b3eb1f0..148207395 100644 --- a/webgoat-lessons/xxe/src/main/java/org/owasp/webgoat/plugin/SimpleXXE.java +++ b/webgoat-lessons/xxe/src/main/java/org/owasp/webgoat/plugin/SimpleXXE.java @@ -59,7 +59,7 @@ public class SimpleXXE extends Assignment { public AttackResult createNewUser(@RequestBody String userInfo) throws Exception { User user = parseXml(userInfo); if (checkSolution(user)) { - return AttackResult.success(String.format("Welcome %s", user.getUsername())); + return AttackResult.success(String.format("Congratulation, welcome %s", user.getUsername())); } return AttackResult.failed("Try again!"); } diff --git a/webgoat-lessons/xxe/src/main/java/org/owasp/webgoat/plugin/XXE.java b/webgoat-lessons/xxe/src/main/java/org/owasp/webgoat/plugin/XXE.java index e8afa5410..43ebad5ac 100644 --- a/webgoat-lessons/xxe/src/main/java/org/owasp/webgoat/plugin/XXE.java +++ b/webgoat-lessons/xxe/src/main/java/org/owasp/webgoat/plugin/XXE.java @@ -45,9 +45,8 @@ public class XXE extends NewLesson { @Override public List getHints() { List hints = new ArrayList(); - hints.add("Try searching with BOS, SFO or OAK"); + hints.add("Try submitting the form and see what happens"); hints.add("XXE stands for XML External Entity attack"); - hints.add("Look at the search form when you submit"); hints.add("Try to include your own DTD"); return hints; } diff --git a/webgoat-lessons/xxe/src/main/resources/plugin/XXE/html/XXE.html b/webgoat-lessons/xxe/src/main/resources/plugin/XXE/html/XXE.html index f6f97050d..22f822ea9 100644 --- a/webgoat-lessons/xxe/src/main/resources/plugin/XXE/html/XXE.html +++ b/webgoat-lessons/xxe/src/main/resources/plugin/XXE/html/XXE.html @@ -49,9 +49,10 @@
- By signing up you agree to WebGoat's Terms of Service.
+
+
@@ -97,13 +98,29 @@
- By signing up you agree to WebGoat's Terms of Service.
+
+
+
+ + +
+
+ +
+ + +
+
+ + \ No newline at end of file diff --git a/webgoat-lessons/xxe/src/main/resources/plugin/XXE/lessonPlans/en/XXE_changing_content_type.adoc b/webgoat-lessons/xxe/src/main/resources/plugin/XXE/lessonPlans/en/XXE_changing_content_type.adoc index 7c09235fc..408e7f438 100644 --- a/webgoat-lessons/xxe/src/main/resources/plugin/XXE/lessonPlans/en/XXE_changing_content_type.adoc +++ b/webgoat-lessons/xxe/src/main/resources/plugin/XXE/lessonPlans/en/XXE_changing_content_type.adoc @@ -1,4 +1,7 @@ == Modern REST framework -Again same exercise but try to enforce the same XML injection as we did in first lesson. +In modern REST frameworks the server might be able to accepts data formats that you as a developer did not think about. +So this might result in JSON endpoints being vulnerable for XXE attacks. + +Again same exercise but try to perform the same XML injection as we did in first lesson. diff --git a/webgoat-lessons/xxe/src/main/resources/plugin/XXE/lessonPlans/en/XXE_mitigation.adoc b/webgoat-lessons/xxe/src/main/resources/plugin/XXE/lessonPlans/en/XXE_mitigation.adoc new file mode 100644 index 000000000..2ba1be885 --- /dev/null +++ b/webgoat-lessons/xxe/src/main/resources/plugin/XXE/lessonPlans/en/XXE_mitigation.adoc @@ -0,0 +1,21 @@ +== XXE mitigation + +In order to protect against XXE attacks you need to make sure you validate the input received from an untrusted client. +In the Java world you can also instruct your parser to ignore DTD completely, for example: + +[source] +---- +XMLInputFactory xif = XMLInputFactory.newFactory(); +xif.setProperty(XMLInputFactory.SUPPORT_DTD, false); +---- + +if you are not able to completely switch off the DTD support, you can also instruct the XML parser to ignore external entities, like: + +[source] +---- +XMLInputFactory xif = XMLInputFactory.newFactory(); +xif.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false); +xif.setProperty(XMLInputFactory.SUPPORT_DTD, true); +---- + +For more information about configuration, see https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Prevention_Cheat_Sheet diff --git a/webgoat-lessons/xxe/src/main/resources/plugin/XXE/lessonPlans/en/XXE_overflow.adoc b/webgoat-lessons/xxe/src/main/resources/plugin/XXE/lessonPlans/en/XXE_overflow.adoc new file mode 100644 index 000000000..22bb5df54 --- /dev/null +++ b/webgoat-lessons/xxe/src/main/resources/plugin/XXE/lessonPlans/en/XXE_overflow.adoc @@ -0,0 +1,30 @@ +== XXE DOS attack + +With the same XXE attack we can perform a DOS service attack towards the server. An example of such an attack is: + +[source] +---- + + + + + + + + + + + + +]> +&lol9; +---- + +When XML parser loads this document, it sees that it includes one root element, "lolz", that contains the text "&lol9;". However, "&lol9;" is a defined +entity that expands to a string containing ten "&lol8;" strings. Each "&lol8;" string is a defined entity that expands to ten "&lol7;" strings, and so on. +After all the entity expansions have been processed, this small (< 1 KB) block of XML will actually contain 109 = a billion "lol"s, taking up almost 3 +gigabytes of memory. + +This is called a "Billion laughs", more information can be found here: https://en.wikipedia.org/wiki/Billion_laughs +