Skip to content

Commit 81036a3

Browse files
breakthesecbreakthesec
committed
xmli
1 parent 187aa58 commit 81036a3

40 files changed

+425
-8
lines changed

‎build/web/ForgotPassword.jsp

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,6 @@
44
<%@page import="java.sql.ResultSet"%>
55
<%@page import="java.sql.Connection"%>
66
<%@ include file="header.jsp" %>
7-
<script src="jquery.min.js" type="text/javascript"></script>
87
<script type="text/javascript">
98
$(document).ready(function(){
109
$("#username").change(function(){

‎build/web/Register.jsp

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,6 @@
44
Author : breakthesec
55
--%>
66
<%@ include file="header.jsp" %>
7-
<script src="jquery.min.js" type="text/javascript"></script>
87
<script type="text/javascript">
98
$(document).ready(function(){
109
$("#username").change(function(){

‎build/web/WEB-INF/classes/.netbeans_automatic_build

Whitespace-only changes.

‎build/web/WEB-INF/classes/.netbeans_update_resources

Whitespace-only changes.

‎build/web/WEB-INF/classes/controller/AddPage.class

97 Bytes
Binary file not shown.

‎build/web/WEB-INF/classes/controller/EmailCheck.class

97 Bytes
Binary file not shown.

‎build/web/WEB-INF/classes/controller/ForwardMe.class

97 Bytes
Binary file not shown.

‎build/web/WEB-INF/classes/controller/LoginValidator.class

97 Bytes
Binary file not shown.

‎build/web/WEB-INF/classes/controller/Logout.class

97 Bytes
Binary file not shown.

‎build/web/WEB-INF/classes/controller/Register.class

97 Bytes
Binary file not shown.

‎build/web/WEB-INF/classes/controller/SendMessage.class

97 Bytes
Binary file not shown.

‎build/web/WEB-INF/classes/controller/UsernameCheck.class

97 Bytes
Binary file not shown.

‎build/web/WEB-INF/classes/controller/XPathQuery.class

97 Bytes
Binary file not shown.

‎build/web/WEB-INF/classes/controller/install.class

97 Bytes
Binary file not shown.

‎build/web/WEB-INF/classes/controller/open.class

97 Bytes
Binary file not shown.

‎build/web/WEB-INF/classes/controller/xxe.class

3.22 KB
Binary file not shown.

‎build/web/WEB-INF/classes/model/DBConnect.class

-165 Bytes
Binary file not shown.

‎build/web/WEB-INF/lib/jstl-api.jar

31.5 KB
Binary file not shown.

‎build/web/WEB-INF/lib/jstl-impl.jar

393 KB
Binary file not shown.

‎build/web/WEB-INF/web.xml

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,10 @@
4444
<servlet-name>XPathQuery</servlet-name>
4545
<servlet-class>controller.XPathQuery</servlet-class>
4646
</servlet>
47+
<servlet>
48+
<servlet-name>xxe</servlet-name>
49+
<servlet-class>controller.xxe</servlet-class>
50+
</servlet>
4751
<servlet-mapping>
4852
<servlet-name>install</servlet-name>
4953
<url-pattern>/install</url-pattern>
@@ -88,4 +92,8 @@
8892
<servlet-name>XPathQuery</servlet-name>
8993
<url-pattern>/XPathQuery.do</url-pattern>
9094
</servlet-mapping>
95+
<servlet-mapping>
96+
<servlet-name>xxe</servlet-name>
97+
<url-pattern>/vulnerability/Injection/xxe.do</url-pattern>
98+
</servlet-mapping>
9199
</web-app>

‎build/web/header.jsp

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@
1515
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />
1616
<title><%=siteTitle%></title>
1717
<link rel="stylesheet" href="<%=path%>/style.css" type="text/css" charset="utf-8" />
18+
<% out.print("<script src=\""+path+"/jquery.min.js\" type=\"text/javascript\"></script>"); %>
1819
</head>
1920

2021
<body>
@@ -39,6 +40,13 @@
3940
<li><a href="<%=path%>/vulnerability/Injection/xpath_login.jsp">Login Bypass</a></li>
4041
</ul>
4142
</li>
43+
<li><a href="#">XML Injection</a>
44+
<ul>
45+
<li><a href="<%=path%>/vulnerability/Injection/xxe.jsp">External Entity</a></li>
46+
<li><a href="<%=path%>/vulnerability/Injection/xslt.jsp?style=1.xsl">XSLT Injection</a></li>
47+
48+
</ul>
49+
</li>
4250
</ul>
4351
</li>
4452

‎build/web/vulnerability/Injection/1.xsl

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
3+
<!--
4+
Document : courses.xsl
5+
Created on : 21 January, 2015, 9:31 PM
6+
Author : breakthesec
7+
Description:
8+
Purpose of transformation follows.
9+
-->
10+
11+
<xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" version="1.0">
12+
<xsl:output method="html"/>
13+
14+
<!-- TODO customize transformation rules
15+
syntax recommendation http://www.w3.org/TR/xslt
16+
-->
17+
<xsl:template match="/">
18+
<h1> List of Courses: </h1>
19+
<table border="1">
20+
<tr>
21+
<th>Course Name</th>
22+
<th>URL</th>
23+
</tr>
24+
<xsl:for-each select="courses/course-details">
25+
<tr>
26+
<td><xsl:value-of select="title"/></td>
27+
<td width="120px" style='text-align:center' >
28+
<xsl:element name="a">
29+
<xsl:attribute name="href">
30+
<xsl:value-of select="url"/>
31+
</xsl:attribute> Sign Up
32+
</xsl:element>
33+
</td>
34+
</tr>
35+
</xsl:for-each>
36+
37+
</table>
38+
39+
</xsl:template>
40+
41+
</xsl:stylesheet>

‎build/web/vulnerability/Injection/2.xsl

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
3+
<!--
4+
Document : courses.xsl
5+
Created on : 21 January, 2015, 9:31 PM
6+
Author : breakthesec
7+
Description:
8+
Purpose of transformation follows.
9+
-->
10+
11+
<xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" version="1.0">
12+
<xsl:output method="html"/>
13+
14+
<!-- TODO customize transformation rules
15+
syntax recommendation http://www.w3.org/TR/xslt
16+
-->
17+
<xsl:template match="/">
18+
<h1> List of Courses: </h1>
19+
20+
<ul>
21+
<xsl:for-each select="courses/course-details">
22+
<li>
23+
<xsl:element name="a">
24+
<xsl:attribute name="href">
25+
<xsl:value-of select="url"/>
26+
</xsl:attribute>
27+
<xsl:value-of select="title"/>
28+
</xsl:element>
29+
</li>
30+
31+
</xsl:for-each>
32+
</ul>
33+
</xsl:template>
34+
35+
</xsl:stylesheet>

‎build/web/vulnerability/Injection/courses.xml

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<courses>
3+
<course-details>
4+
<title>Hacking and Securing Java based Web Applications </title>
5+
<url>https://www.udemy.com/hacking-securing-java-web-programming/</url>
6+
</course-details>
7+
<course-details>
8+
<title>Hacking and Securing PHP Applications </title>
9+
<url>https://www.udemy.com/hacking-securing-php/</url>
10+
</course-details>
11+
<course-details>
12+
<title>Certified White Hat Hacker</title>
13+
<url>https://www.udemy.com/certified-whitehat-hacker-level-1/</url>
14+
</course-details>
15+
<course-details>
16+
<title>Certified APT Defender </title>
17+
<url>https://www.udemy.com/certified-apt-defender/</url>
18+
</course-details>
19+
</courses>

‎build/web/vulnerability/Injection/xslt.jsp

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
2+
<%@ include file="/header.jsp" %>
3+
<%@ taglib uri="http://java.sun.com/jsp/jstl/core" prefix="c" %>
4+
<%@ taglib prefix="x" uri="http://java.sun.com/jsp/jstl/xml" %>
5+
<form >
6+
Select Style: <select name="style">
7+
<option value="1.xsl">Style 1</option>
8+
<option value="2.xsl">Style 2</option>
9+
</select>
10+
<input type="submit" value="change"/>
11+
</form><br/>
12+
<c:import url="courses.xml" var="xml"/>
13+
14+
<c:import url='${param["style"]}' var="xslt"/>
15+
<x:transform xml="${xml}" xslt="${xslt}"/>
16+
17+
<%@ include file="/footer.jsp" %>

‎build/web/vulnerability/Injection/xxe.jsp

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
2+
<%@ include file="/header.jsp" %>
3+
<script type="text/javascript">
4+
$(document).ready(function(){
5+
$("#req").click(function(){
6+
var xml = '<?xml version="1.0" encoding="UTF-8"?><users><username>Neo</username><email>neo@matrix</email></users>';
7+
$.ajax({
8+
url: 'xxe.do',
9+
processData: false,
10+
type: "POST",
11+
data: xml,
12+
success: function(response){
13+
$("#result").html(response);
14+
},
15+
error: function(response) {
16+
$("#result").html(response);
17+
}
18+
19+
});
20+
});
21+
});
22+
</script>
23+
24+
<input type="button" id="req" name="req" value="Send Request"/> <br/>
25+
<div id="result"></div>
26+
<%@ include file="/footer.jsp" %>

‎nbproject/build-impl.xml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -999,12 +999,14 @@ exists or setup the property manually. For example like this:
999999
<target depends="init" if="dist.ear.dir" name="library-inclusion-in-manifest">
10001000
<copyfiles files="${file.reference.mysql-connector-java-5.1.33-bin.jar}" iftldtodir="${build.web.dir}/WEB-INF" todir="${dist.ear.dir}/lib"/>
10011001
<copyfiles files="${file.reference.json-20090211.jar}" iftldtodir="${build.web.dir}/WEB-INF" todir="${dist.ear.dir}/lib"/>
1002+
<copyfiles files="${libs.jstl.classpath}" iftldtodir="${build.web.dir}/WEB-INF" todir="${dist.ear.dir}/lib"/>
10021003
<mkdir dir="${build.web.dir}/META-INF"/>
10031004
<manifest file="${build.web.dir}/META-INF/MANIFEST.MF" mode="update"/>
10041005
</target>
10051006
<target depends="init" name="library-inclusion-in-archive" unless="dist.ear.dir">
10061007
<copyfiles files="${file.reference.mysql-connector-java-5.1.33-bin.jar}" todir="${build.web.dir}/WEB-INF/lib"/>
10071008
<copyfiles files="${file.reference.json-20090211.jar}" todir="${build.web.dir}/WEB-INF/lib"/>
1009+
<copyfiles files="${libs.jstl.classpath}" todir="${build.web.dir}/WEB-INF/lib"/>
10081010
</target>
10091011
<target depends="init" if="dist.ear.dir" name="-clean-webinf-lib">
10101012
<delete dir="${build.web.dir}/WEB-INF/lib"/>

‎nbproject/genfiles.properties

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
1-
build.xml.data.CRC32=c2a19c05
1+
build.xml.data.CRC32=903755fa
22
build.xml.script.CRC32=8f523743
33
build.xml.stylesheet.CRC32=651128d4@1.67.1.1
44
# This file is used by a NetBeans-based IDE to track changes in generated files such as build-impl.xml.
55
# Do not edit this file. You may delete it but then the IDE will never regenerate such files for you.
6-
nbproject/build-impl.xml.data.CRC32=c2a19c05
7-
nbproject/build-impl.xml.script.CRC32=8ead9884
6+
nbproject/build-impl.xml.data.CRC32=903755fa
7+
nbproject/build-impl.xml.script.CRC32=084958d7
88
nbproject/build-impl.xml.stylesheet.CRC32=99ea4b56@1.67.1.1

‎nbproject/project.properties

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,8 @@ j2ee.server.type=Tomcat
4040
jar.compress=false
4141
javac.classpath=\
4242
${file.reference.mysql-connector-java-5.1.33-bin.jar}:\
43-
${file.reference.json-20090211.jar}
43+
${file.reference.json-20090211.jar}:\
44+
${libs.jstl.classpath}
4445
# Space-separated list of extra javac options
4546
javac.compilerargs=
4647
javac.debug=true

‎nbproject/project.xml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,10 @@
1414
<file>${file.reference.json-20090211.jar}</file>
1515
<path-in-war>WEB-INF/lib</path-in-war>
1616
</library>
17+
<library dirs="200">
18+
<file>${libs.jstl.classpath}</file>
19+
<path-in-war>WEB-INF/lib</path-in-war>
20+
</library>
1721
</web-module-libraries>
1822
<web-module-additional-libraries/>
1923
<source-roots>

‎src/java/controller/xxe.java

Lines changed: 106 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,106 @@
1+
/*
2+
* To change this license header, choose License Headers in Project Properties.
3+
* To change this template file, choose Tools | Templates
4+
* and open the template in the editor.
5+
*/
6+
7+
package controller;
8+
9+
import java.io.IOException;
10+
import java.io.InputStream;
11+
import java.io.PrintWriter;
12+
import javax.servlet.ServletException;
13+
import javax.servlet.http.HttpServlet;
14+
import javax.servlet.http.HttpServletRequest;
15+
import javax.servlet.http.HttpServletResponse;
16+
import javax.xml.parsers.DocumentBuilder;
17+
import javax.xml.parsers.DocumentBuilderFactory;
18+
import org.w3c.dom.Document;
19+
import org.w3c.dom.Element;
20+
import org.w3c.dom.NodeList;
21+
import org.xml.sax.InputSource;
22+
23+
/**
24+
*
25+
* @author breakthesec
26+
*/
27+
public class xxe extends HttpServlet {
28+
29+
/**
30+
* Processes requests for both HTTP <code>GET</code> and <code>POST</code>
31+
* methods.
32+
*
33+
* @param request servlet request
34+
* @param response servlet response
35+
* @throws ServletException if a servlet-specific error occurs
36+
* @throws IOException if an I/O error occurs
37+
*/
38+
protected void processRequest(HttpServletRequest request, HttpServletResponse response)
39+
throws ServletException, IOException {
40+
response.setContentType("text/html;charset=UTF-8");
41+
PrintWriter out = response.getWriter();
42+
try
43+
{
44+
InputStream xml=request.getInputStream();
45+
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
46+
DocumentBuilder builder = factory.newDocumentBuilder();
47+
InputSource is = new InputSource(xml);
48+
Document doc = builder.parse(is);
49+
Element element = doc.getDocumentElement();
50+
NodeList nodes = element.getChildNodes();
51+
out.print("<br/>Result:<br/>");
52+
out.print("---------------------<br/>");
53+
for (int i = 0; i < nodes.getLength(); i++) {
54+
out.print(nodes.item(i).getNodeName()+" : " + nodes.item(i).getTextContent());
55+
out.print("<br/>");
56+
}
57+
}
58+
catch(Exception ex)
59+
{
60+
out.print(ex);
61+
}
62+
finally {
63+
out.close();
64+
}
65+
}
66+
67+
// <editor-fold defaultstate="collapsed" desc="HttpServlet methods. Click on the + sign on the left to edit the code.">
68+
/**
69+
* Handles the HTTP <code>GET</code> method.
70+
*
71+
* @param request servlet request
72+
* @param response servlet response
73+
* @throws ServletException if a servlet-specific error occurs
74+
* @throws IOException if an I/O error occurs
75+
*/
76+
@Override
77+
protected void doGet(HttpServletRequest request, HttpServletResponse response)
78+
throws ServletException, IOException {
79+
processRequest(request, response);
80+
}
81+
82+
/**
83+
* Handles the HTTP <code>POST</code> method.
84+
*
85+
* @param request servlet request
86+
* @param response servlet response
87+
* @throws ServletException if a servlet-specific error occurs
88+
* @throws IOException if an I/O error occurs
89+
*/
90+
@Override
91+
protected void doPost(HttpServletRequest request, HttpServletResponse response)
92+
throws ServletException, IOException {
93+
processRequest(request, response);
94+
}
95+
96+
/**
97+
* Returns a short description of the servlet.
98+
*
99+
* @return a String containing servlet description
100+
*/
101+
@Override
102+
public String getServletInfo() {
103+
return "Short description";
104+
}// </editor-fold>
105+
106+
}

‎web/ForgotPassword.jsp

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,6 @@
44
<%@page import="java.sql.ResultSet"%>
55
<%@page import="java.sql.Connection"%>
66
<%@ include file="header.jsp" %>
7-
<script src="jquery.min.js" type="text/javascript"></script>
87
<script type="text/javascript">
98
$(document).ready(function(){
109
$("#username").change(function(){

‎web/Register.jsp

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,6 @@
44
Author : breakthesec
55
--%>
66
<%@ include file="header.jsp" %>
7-
<script src="jquery.min.js" type="text/javascript"></script>
87
<script type="text/javascript">
98
$(document).ready(function(){
109
$("#username").change(function(){

‎web/WEB-INF/web.xml

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,10 @@
4444
<servlet-name>XPathQuery</servlet-name>
4545
<servlet-class>controller.XPathQuery</servlet-class>
4646
</servlet>
47+
<servlet>
48+
<servlet-name>xxe</servlet-name>
49+
<servlet-class>controller.xxe</servlet-class>
50+
</servlet>
4751
<servlet-mapping>
4852
<servlet-name>install</servlet-name>
4953
<url-pattern>/install</url-pattern>
@@ -88,4 +92,8 @@
8892
<servlet-name>XPathQuery</servlet-name>
8993
<url-pattern>/XPathQuery.do</url-pattern>
9094
</servlet-mapping>
95+
<servlet-mapping>
96+
<servlet-name>xxe</servlet-name>
97+
<url-pattern>/vulnerability/Injection/xxe.do</url-pattern>
98+
</servlet-mapping>
9199
</web-app>

0 commit comments

Comments
 (0)