> For the complete documentation index, see [llms.txt](https://simon-6.gitbook.io/simoncyber/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://simon-6.gitbook.io/simoncyber/ctf-writeups/picoctf-2023/web-exploitation/soap.md). # SOAP
First of all what is SOAP? **"SOAP** (Simple Object Access Protocol) is a protocol used to exchange structured information in the implementation of web services. It uses **XML-based messaging** and is designed to be platform and language independent. It means API calls will use xml formatted body and we can try XXE attack to retrieve the content of /etc/passwd file." First of all I think we should know what XML even is: ### What is XML? * XML stands for eXtensible Markup Language * XML is a markup language much like HTML * XML was designed to store and transport data * XML was designed to be self-descriptive * XML is a W3C Recommendation In other words, XML functions as like a "tagging" language that are used to transport information. Unlike HTML, which has tags predefined like syntax in a language, you can define your own tags in XML. This is what makes it so versatile. It looks like HTML in that it uses angle-bracket tags, but the difference is that you invent the tag names yourself — there's no fixed vocabulary like `
` or `

`. A document might look like `book2`, and the meaning of those tags is whatever the application says they mean. XML has fallen out of fashion as a transport format (JSON is lighter, plays nicer with JavaScript), but it's still everywhere under the hood: SOAP APIs, SAML for SSO, RSS, DOCX/XLSX/PPTX files (which are just zipped XML), Android manifests, configuration files, and so on. That ubiquity is exactly why XXE is still a relevant bug class. ``` #XML Tove Jani Reminder Don't forget me this weekend! #HTML

My Cat

She is fluffy.

``` An **entity** in XML is essentially a named placeholder that the parser expands into some value before the document is processed. Think of it like a `#define` in C or a variable in a template engine — when the parser sees `&name;` in the document body, it substitutes in whatever `name` resolves to. The five entities that ship built-in are `<` `>` `&` `"` and `'`, which expand to `<`, `>`, `&`, `"`, and `'` respectively. They exist because those characters have structural meaning in XML — if your data contains a literal `<`, you can't just write it, or the parser will think you're starting a new tag. So you write `<` and the parser turns it back into `<` for you. Imagine it as just a alias for something that is defined. *** The reason custom entities exist at all is the **Document Type Definition (DTD)**. A DTD is an optional schema-ish block that sits at the top of an XML document and tells the parser what the document is supposed to look like — what elements are allowed, what attributes they can have, what entities are defined, etc. It lives inside a `DOCTYPE` declaration, and there are three variants: * **Internal DTD** — written inline: `` * **External DTD** — loaded from a URL: `` However, you can see the vulnerability that can take place here. We don't need to fetch from a website for a variable and place it in to "foo", it can be pretty much anything. ``` ]> &ext; ``` This is the core of what XXE is: That's the whole foundation of XXE. The chain is: * XML = text with custom tags wrapping data * Entities = shortcuts that look like `&name;` and get swapped for a value when parsed * DTD = the block at the top where you can define your own entities * External entities = entities whose value gets fetched from a URL at parse time * `file://` in an external entity = parser reads files off the server's disk and hands them to you. So let's get started shall we? ***
First of all we analyze the input through the Proxy Tab in Burpsuite. Next, we copy paste the contents from the website into Repeater. This is used to send data to the website, and using our XXE payload, we get the flag!