Now let's see similar external entity attack in live action.
So here in this Celexa we'll see in the left.
So I found this so wonderful left for us to test so you can simply go to this Web site that has been
destroyed left and it is inside this exercise.
So after that we must go inside maybe wait for pain this time.
So this is our final loves it so all you need to do is simply don't do this iso file simply click here
to download the file.
I will just download it so you can simply press okay to download this file.
It will just give the link you can start the download to the file and after you download you'll just
get this iso file in the drive where you just restored this.
So after that you have to first of all OK
so let me just go here real quick.
So after users download that all you get is the virtual box we have a little you download the virtual
box from the previous couple of lectures.
And now first of all you simply click on this new and give any name so you can just give something like
this too.
So in my case I have already made the virtual box for this so the next one is the Linux over here type
would be leaks and it should be Debian 64 for me.
So next is to simply give one TV show on TV not for this so you can simply give the something in the
M B to something like 512 and B.
So next.
So this create this So next I want dynamically allocated.
So next one is edgy.
So create split that uses to get this up and running here.
But first you have to the slower that ISAF file.
So simply go to the stories here in these stories and click on this empty and simply load from here.
So in my case it would be way for Pan tester dot ISO.
So I'll simply load this and the next one is very important you have to go in the network.
So it should be heard network and simply press a breeze to adapt over here.
Otherwise it won't work.
So if it would be net for you then it is not going to work so simply press a breezy adapter click okay
and simply press start.
But at this remove this one because I have already made this.
So when is a space this one ends so are basically windows press start.
It would be start for you.
I have so because I've already run over here.
So you'll just get this window in after it.
Lord you have to press I have config to see your IP address.
It should be something like this.
So it should be one 90 to 168 and the link it will just give the IP address.
So all you need to do is simply put here that is IP config or I have config not your IP you should be
here.
Let me show you I have config when you this press that you'll just get here.
That is the IP address in this eat you 0 are basically where you can simply see here.
So this would be your IP address.
Copy this IP.
So you need to copy this IP address and go to your windows or mac or bench or it can be Linux open the
web browser and in the web browser you can simply paste that IP address whenever it into.
Then you will just get these home base for pain destroy.
So over here we have a bunch of exercises.
You can see all the exercises.
That is we have already done that can be the axis this attack.
So you can also simply go to this example the exercise and you can see that in this field because it
is the parameter name so you can see that it has injected the hacker.
So if I just say such in the end need to say that Hello such and over here.
That means it has a reflection.
That means it has reflected excesses.
So simply put a simple payload here.
So this is the script and alert keep one here or any payload you want to load.
And when I just press into then you'll see that one yards reflect over here.
So this would be a couple of exercises you can test over here.
But now we can see that is similar taxable here.
So we'll see.
It's similar to our example external entity attack in dyslexia.
That means will this go to these six similar attacks and simply press this example one.
So in this example you can see that we have a link and it has a barometer of X amount so less index
something over here.
So you can see it has injected some unique word over here.
Based on that example chord because we knew in the simple chord the tag are user defined it is not the
predefined is the case of the estimate.
If it was a statement you cannot make this test a tag.
It should be predefined that is defined by the language itself.
But in the case of maximal it can be user defined.
So let's make other quarter over here.
So let me just open my sublime and here.
Let's go over here and let me just make a user defined code so let me say you read me and I'll say hey
and you read me again.
So this is your example.
COR So let me just copy this and instead of this you can paste your own link give way.
So this is press that you could see this.
It says to hello here.
So you can say something like You they me again when I press into it and you could say hello you to
me over here.
So it has a reflection in these web content but we can do something like the web or basically use of
some payload of the example to extract some of the useful information.
So let's make our own next e-mail external entity attack code.
So we'll just make our own payload now and it up on the sublime again.
So first I'll just make use of this duct tape
and after that I'll make use of something like this so it can be anything for you so you can just put
anything over here.
So I'm just making a costume tag that is name with the test and I'll just open this entity tag and after
that I simply pass the ecstasy which is also the given the name for this file will be stored so we'll
just make use of some system cured.
So I'll just tell you in a moment what this system is.
So first of all this let me put the file in real quick over here.
So the file I want to extract from the server is its EDC file or folder and inside the CDC I want to
extract password.
So this would be file.
And after that I'll disclose this entity.
And let me disclose again this one.
After that I have to make my external entity are basically the symbol Gordon.
So let me simply make something like this.
So as a smoke test I want to inject this content of password into yuks the x e file.
So I have this stored over here and let me just close this first.
And after that I want to close my test.
So you could see we have completed our payload over here.
So the most important thing over here is this system keyword so system cure is the keyword that tells
the next e-mail parser that it wants to fit this file from the server.
So we have already said in the theory section in the early lecture of these six and that we want to
extract something from the server or something from the remote our local file.
Then we make use of a simple parser.
So we similar and we see this system cured and it's in this phase this file are basically the system
file and you do this is stored in the sexy.
And we'll see the content of this in the web content so instead of this you to me we'll see the content.
So instead of you they mean not only Halo was basically the predefined content of the space so instead
of you to me we'll see the whole content of young 6.
You were here which is basically the content of the password inside this secure folder or it folder.
So let me just copy this.
So this our payload.
So I'll just go to the browser.
So now we have to first encode this so in order to make encoding I'll use something like encoder decoder.
So let me just source for your URL encoder decoder.
Let me just go to this Web site and here I'll just paste our payload which is the same payload.
I'll just encode this.
And let me just copy this now.
This copy this and instead of this file that we just injected we want to inject the encoded you are.
So I'll just put here in corded payload and allow this heat into then you can see we just got this route
this is.
So this the content.
So from here from this route to this is the content of that folder or basically which is the folder
are basically the content of the space password.
So you can see that we have now printed the password content with the help of this system keyword that
will tell the similar password to just reflect this password field or basically the content a password
in this browser so you can see we have got successfully the password filter basically the content the
password with this attack over here which is eczema external entity attack.
So you can do something like this payload in pseudo password you can also get the host content.
If you want to host content then you can simply sense that copy that again go to the URL encoder decoder
pasted here and encode this and copy this again.
Go back here.
So instead of this you have to pace the new file our new content of the payload or encoded content basically
any phases heat into it will be the content of the source.
So you can see the server is running the local host division and this is the content of these host which
is inside this idiocy folder.
So you have successfully got the content of yes the X E which is basically giving the content of the
remote file which is hosted in the server with this content you can also assess all the filesystem of
the server with these simple attack which is named is simple external entity which will tell the parser
to fix the system filesystem or basically to fix the system file with these simple payload.
So this is the type of the external XML entity.
So we just got on the attack.
Here we see the content of this puzzle.
And we also see the content of the source so you can also simply go to the next example and source for
the similar tag or basically you can also see some of the examples in this lab so you can see for the
access is make your own payload execute that the accesses attack.
You can see for these six similar.
So I'll see you in the next one.