+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: bWAPP XXE Error (/showthread.php?tid=6006728)
bWAPP XXE Error - srikanthr - Sep 10, 2019
I am seeing a Error during XXE Attack simulation using bWAPP. I tried debugging by printing following:
$xml = simplexml_load_string($body);
// Debugging
print_r($xml);
$login = $xml->login;
$secret = $xml->secret;
echo "Login = " . $login;
echo "Secret = " . $secret;
I am seeing an An Error Occured because login is having empty content since SYSTEM command is not executing as expected in bWAPP
ENTITY xxe SYSTEM
Quote:file:///etc/passwd
<reset><login>&xxe;</login><secret>blah</secret>/reset>
Any Inputs on this is much appreciated.
Thanks
Srikanth
RE: bWAPP XXE Error - compalabee - Sep 11, 2019
The system command isn't supposed to display content. It should execute a command that gives content.
Have you tried "cat file:///etc/passwd"?