XXE Firing Range

The XXE Firing Range (xxefr) is designed to provide a learning environment for XXE attacks. xxefr is a Vagrant-based virtual machine provisioned with Ansible and has three components: a documentation site, a Java application and a PHP application. The vagrant box also includes an Eclipse install so that you can view and modify the Java app.

Installation

Prerequisites

VirtualBox
Vagrant
Ansible
Port 8085 free

Installing the Prequisites

Arch Linux

sudo pacman -Sy virtualbox vagrant ansible

Debian-based OS (Debian, Ubuntu, Kali)

sudo apt install virtualbox vagrant ansible

Installing xxefr

git clone --recursive https://github.com/tjcim/xxefr
cd xxefr
vagrant up

Once up visit https://localhost:8085, there you will find links to the documentation site as well as the Java application.

Java Application Username/Password: user@xxefr.com:xxe

XXEFR Components

Documentation Site

http://localhost:8085/docs/

Exercises

First we review a bit about XML, define DTDs as well as Entities and then establish some rules for both to follow while building your attacks. The documentation then has exercises and example attacks that can be used against the Java application and the PHP application.

Basic XXE
Blind XXE
Error-based XXE
Using CDATA
Brute-force local files
TCP port scan
SSRF
Billion-laughs DOS
XXE to RCE

Tools

Tools are available in the /home/vagrant/tools directory and the documentation includes exercises on how to use each.

xxeftp
230-OOB
XXEinjector

Java Site

http://localhost:8085/xxe/

Practice the exercises found in the documentation site here. The Java site has three main endpoints:

Protected - this endpoint follows OWASP guidelines and should be protected from XXE
Basic - this endpoint allows for basic XXE exploits
Blind - this endpoint only allows for blind or error-based exploits

PHP Site

http://localhost:8085/php/

There are some specific exercises for the PHP site that include some differences between it an Java. In addition you will be able to practice Remote Code Execution as well as upload a webshell all using XXE.

URLs for the apps

Hugo docs: http://localhost:8085/docs/
Java Site: http://localhost:8085/xxe/
PHP Site: http://localhost:8085/php/
Firing Range run from Eclipse: http://localhost:9090/xxe/ *
Hugo dev server: http://localhost:1313 *

* - These are not started by default

Local Files

DTD files are found here: /home/vagrant/dtds
Test files are found here: /home/vagrant/test_files
XXE tools are found here: /home/vagrant/tools