# XXE Infiltration Lab
Q1) Knowing which open ports have been discovered by the attacker allows us to understand which services are exposed and potentially targeted. Can you provide the highest numbered port open on the victim web server?
```
tcp.flags.syn == 1 and tcp.flags.ack == 1
```
```bash
tshark -r XXEInfiltration.pcap -Y "tcp.flags.syn == 1 and tcp.flags.ack == 1" -T fields -e tcp.srcport | sort | uniq
```
Answer: 3306
Q2) By identifying the vulnerable PHP script, security teams can directly address and mitigate the vulnerability. What's the complete URI of the PHP script vulnerable to XXE Injection?
```
http contains "
Answer: /review/upload.php
Q3) To construct the attack timeline and determine the initial point of compromise. What's the name of the first malicious XML file uploaded by the attacker?
Answer: TheGreatGatsby.xml
Q4) Understanding which sensitive files were accessed helps evaluate the breach's potential impact. What's the name of the web app configuration file the attacker read?
```
http.response.code == 200
```
Answer: config.php
Q5) Determining the extent of the breach, what's the password of the compromised database user?
```
http.response.code == 200
```
Answer: Winter2024
Q6) Following the database user compromise. What's the UTC timestamp of the attacker's first connection with the MySQL server in attempt to utilize the compromised credentials?
The attacker get the username and password for the database at 2024-05-31 12:03:12.
```
tcp.port == 3306
```
Answer: 2024-05-31 12:08:49
Q7) To eradicate the threat and prevent further unauthorized access, can you identify the name of the web shell the attacker uploaded for remote code execution and persistence?
```
http.response.code == 200
```
Answer: booking.php
---
# Agent Instructions: Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter:
```
GET https://faresbltagy.gitbook.io/footprintinglabs/cyberdefenders/xxe-infiltration-lab.md?ask=
```
The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.