XXE: Reading Files and Reaching Internal Services Through XML

What it is#

An XML parser that resolves external entities will fetch or read whatever a <!ENTITY> definition points it at, on the server's behalf, whenever it parses a document you supply.

The labs here#

• InvoicePilot XML import file read: the classic, in-band version. Define an external entity pointing at a local file, reference it somewhere the parsed result gets reflected back to you, and read the file directly in the response.
• FlightLog GPX out-of-band XXE: nothing comes back in the response this time. You need a two-step entity (one that reads a local file, then a second that sends its content to a server you control) to exfiltrate anything at all.

Tools that help#