Agent Wranglers

Injection Required

Turn off external entities in XML

Parse XML with external entities and document types turned off, or accept JSON instead.

By Erik Bergstedt, Agent Wranglers. Updated .

How to do it

Set the parser options that disable DTDs and external entities. Many parsers still allow them by default. Remember that SVG images, office files and SAML messages are XML too.

Example

<?xml version="1.0"?>
<!DOCTYPE t [<!ENTITY aw SYSTEM "file:///etc/hostname">]>
<t>&aw;</t>

How to check

Upload an XML or SVG file that defines an entity pointing at file:///etc/hostname. The reply never contains the server's host name.

For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers security testing playbook: https://agentwranglers.se/playbook/adversarial-testing/injection/xml-entities.