8000 Broken parsing - wrong host · Issue #10 · NetSPI/Wsdler · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

Broken parsing - wrong host #10

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
floyd-fuh opened this issue Apr 4, 2022 · 0 comments
Open

Broken parsing - wrong host #10

floyd-fuh opened this issue Apr 4, 2022 · 0 comments

Comments

@floyd-fuh
Copy link
floyd-fuh commented Apr 4, 2022 •
edited
Loading

Hi there,

I've encountered it several times already that the hostname and port where requests are sent to are wrong. In my current example this leads to a fully unusable extension. After parsing the WSDL, it will fetch the XSD from the server. The XSD has a reference:

<xsd:import namespace="http://www.w3.org/2005/05/xmlmime"

However, the extension then fetches /2005/05/xmlmime from the server where the WSDL is located instead of www.w3.org. Of course that results in a 403 HTML response and then the parser fails with:

WSDLException (at /wsdl:definitions/wsdl:types/xsd:schema/xsd:schema): faultCode=PARSER_ERROR: Problem parsing 'http://www.w3.org/2005/05/xmlmime'.: org.xml.sax.SAXParseException: The element type "meta" must be terminated by the matching end-tag "</meta>".

Looks like the parsing logic here is wrong:

Wsdler/src/main/java/burp/WSDLParser.java

Line 145 in 102d9de

String host = getHost(builder.getServiceUrls().get(0));

Workaround:

Had to proxy Burp through Burp and intercept HTTP responses, then simply replace the 404 status code with 200 and paste the XML response of view-source:https://www.w3.org/2005/05/xmlmime
@floyd-fuh floyd-fuh changed the title Broken parsing Broken parsing - wrong host Apr 4, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@floyd-fuh
0