> For the complete documentation index, see [llms.txt](https://writeups.adityadindi.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://writeups.adityadindi.com/tryhackme/walkthroughs-easy/xxe.md).

# XXE

![](/files/-Mefjri-31Og8D59K83I)

## Introduction

![](/files/-MefkluXdDr3LVXKjwMz)

## eXtensible Markup Language

![](/files/-Mefl8IDRx3AlzYO8i2B)

![](/files/-MeflLe6VpAu4mlqwDC6)

![](/files/-MefldT__P2iqlbscG1b)

## DTD

![](/files/-MeflzTLUgZn4oLirVwA)

![](/files/-MefmASoUTIXKf1xF0Rl)

## XXE Payload

![](/files/-MefmMGafdFnF-2G4wRX)

## Exploiting

![](/files/-Mefn7oeviRwmz1Mu9zL)

Lets start burp and visit the webpage

![](/files/-MefnUuBCXfXwWI9tJWm)

Now lets try to display our name on the page

![](/files/-MefnkcAjfEWu_TDG2xD)

The payload works, now lets try reading the /etc/passwd file

![](/files/-Mefnth0ctvhvNWga_cZ)

We can read it

![](/files/-Mefo-cbgW7Tto7usfUb)

Now lets try to read the user falcon's id\_rsa file, which is also his private key

![](/files/-MefoBtlJ5FVnNSLHbTe)

We can look at it better in the source code

![](/files/-MefoHZRQ8-_FUbxukRI)

![](/files/-MefoTAoqBgV178hGUOE)