# XXE

### 5/

Adding the DOCTYPE , a new ENTITY pointing to the filesystem root:

![](https://3988928172-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F18Xd0xa2XUhryqgx9yEk%2Fuploads%2FlwO1Zc4ZXXUVJ9LuL7mZ%2Fimage.png?alt=media\&token=4c8a419b-4c5d-485e-8c5b-3a789e6adc5c)

### 7/

Modify request with Burpsuite, you can see the data is in json type.

The response is: "You are posting JSON which does not work with a XXE"

![](https://3988928172-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F18Xd0xa2XUhryqgx9yEk%2Fuploads%2F2O8RreRSedCZPvIAXhfS%2Fimage.png?alt=media\&token=a9c46e7a-4f38-42c3-8d8d-be89facdb330)

First, you must change Content-Type from application/json to application/xml. Next, do similarly with past challenge:

![](https://3988928172-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F18Xd0xa2XUhryqgx9yEk%2Fuploads%2FPDC8m6oDc7XLS6hGA4AF%2Fimage.png?alt=media\&token=6ee9eb31-c880-4b39-9369-1f5bbe9c29ce)

### 11/ Blind XXE assignment

File to upload to webgoft:

```xml
<?xml version="1.0" encoding="UTF-8"?>
<!ENTITY secret SYSTEM 'file:///home/webgoat/.webgoat-8.2.2//XXE/secret.txt'>
```

Modify Post request (post command with burpsuite) and edit to:

![](https://3988928172-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F18Xd0xa2XUhryqgx9yEk%2Fuploads%2FmJHE3BnaIhO2Gs6mOAH0%2Fimage.png?alt=media\&token=dad233a2-abee-4039-9e40-5af3c759151e)

Reload page and submit value you receive:

![](https://3988928172-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F18Xd0xa2XUhryqgx9yEk%2Fuploads%2FsDCWlprAzM0h6BOtZKXX%2Fimage.png?alt=media\&token=4c2c735c-421f-4c82-a385-47ca32358235)

