[srikanthr]

I am seeing a Error during XXE Attack simulation using bWAPP. I tried debugging by printing following:
   $xml = simplexml_load_string($body);

   // Debugging
   print_r($xml);

   $login = $xml->login;
   $secret = $xml->secret;
   echo "Login = " . $login;
   echo "Secret = " . $secret;

I am seeing an An Error Occured because login is having empty content since SYSTEM command is not executing as expected in bWAPP

ENTITY xxe SYSTEM

file:///etc/passwd

<reset><login>&xxe;</login><secret>blah</secret>/reset>

Any Inputs on this is much appreciated.

Thanks
Srikanth

[compalabee]

The system command isn't supposed to display content. It should execute a command that gives content.

Have you tried "cat file:///etc/passwd"?