> For the complete documentation index, see [llms.txt](https://writeups.adityadindi.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://writeups.adityadindi.com/tryhackme/walkthroughs-easy/xxe.md).

# XXE

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MefV9CbqWw4n0HZ3fSy%2F-Mefjri-31Og8D59K83I%2Fimage.png?alt=media\&token=a7e961f3-9b93-4986-a72f-5cadb42dc5fa)

## Introduction

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MefV9CbqWw4n0HZ3fSy%2F-MefkluXdDr3LVXKjwMz%2Fimage.png?alt=media\&token=7c468909-fe56-4d07-8f8e-99fc32210f9a)

## eXtensible Markup Language

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MefV9CbqWw4n0HZ3fSy%2F-Mefl8IDRx3AlzYO8i2B%2Fimage.png?alt=media\&token=a60fc7f1-c7e6-4663-8a1a-95f8e4c75325)

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MefV9CbqWw4n0HZ3fSy%2F-MeflLe6VpAu4mlqwDC6%2Fimage.png?alt=media\&token=2a423c28-67b4-4829-bc2a-6557af95ffac)

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MefV9CbqWw4n0HZ3fSy%2F-MefldT__P2iqlbscG1b%2Fimage.png?alt=media\&token=eeb2eae2-8793-4cfe-90f5-00d79138af09)

## DTD

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MefV9CbqWw4n0HZ3fSy%2F-MeflzTLUgZn4oLirVwA%2Fimage.png?alt=media\&token=b7d7022b-ad8b-46ac-9e69-62fae3a85589)

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MefV9CbqWw4n0HZ3fSy%2F-MefmASoUTIXKf1xF0Rl%2Fimage.png?alt=media\&token=4eeb4f6c-6c5f-44af-be3c-c6f5199550cb)

## XXE Payload

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MefV9CbqWw4n0HZ3fSy%2F-MefmMGafdFnF-2G4wRX%2Fimage.png?alt=media\&token=d8744901-ecf0-46fb-9c94-a02890e62d4f)

## Exploiting

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MefmNhwOlMysuAeYjrz%2F-Mefn7oeviRwmz1Mu9zL%2Fimage.png?alt=media\&token=35a497b9-dc24-4b87-813d-42e39c2e9709)

Lets start burp and visit the webpage

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MefmNhwOlMysuAeYjrz%2F-MefnUuBCXfXwWI9tJWm%2Fimage.png?alt=media\&token=6d2691e4-1149-4143-bb59-728e22f91558)

Now lets try to display our name on the page

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MefmNhwOlMysuAeYjrz%2F-MefnkcAjfEWu_TDG2xD%2Fimage.png?alt=media\&token=f4cfe75d-60ec-4dc3-88b9-5bb073ea6fdf)

The payload works, now lets try reading the /etc/passwd file

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MefmNhwOlMysuAeYjrz%2F-Mefnth0ctvhvNWga_cZ%2Fimage.png?alt=media\&token=1fac9cb2-3763-49cd-9128-26b8a4d345e5)

We can read it

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MefmNhwOlMysuAeYjrz%2F-Mefo-cbgW7Tto7usfUb%2Fimage.png?alt=media\&token=68d06ae5-b287-4a12-8271-caba37a986b2)

Now lets try to read the user falcon's id\_rsa file, which is also his private key

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MefmNhwOlMysuAeYjrz%2F-MefoBtlJ5FVnNSLHbTe%2Fimage.png?alt=media\&token=52a34bb3-05cb-43fc-8f07-f345beef4bfd)

We can look at it better in the source code

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MefmNhwOlMysuAeYjrz%2F-MefoHZRQ8-_FUbxukRI%2Fimage.png?alt=media\&token=fb8a5b5b-ed52-4937-ae34-a8c502473b4c)

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MefmNhwOlMysuAeYjrz%2F-MefoTAoqBgV178hGUOE%2Fimage.png?alt=media\&token=328500ff-0e82-4673-aafd-601a781b2e56)