0

I just want a little help, i'm not able to exploit an XXE.

<?xml version="1.0" encoding="UTF-8"?>
<response>
<list>
<listname><![CDATA[h]]><!ELEMENT r ANY ><!ENTITY sp SYSTEM "file:///etc/passwd"><![CDATA[h]]></listname>
<listid>1</listid>
<current><![CDATA[true]]></current>
</list>
<timestamp>Saturday, May  4, 2019  9:30:08 PM EDT</timestamp>
</response>

Above is the response from the application, here I can control the listname value, and I was able to escape the cdata protection by this payload

h]]><!ELEMENT r ANY ><!ENTITY sp SYSTEM "file:///etc/passwd"><![CDATA[h

But I wasn't able to get the external files, the Element part become Green in the response.

enter image description here

  • Just found out that the XML parser is showing error because of "!" character, can i still exploit this? – user8255299 May 5 at 2:10
  • Depends on the xml parser/processor used and the escaping done, but recent parsers should not be vulnerable to this. – eckes May 5 at 14:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.