Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Error in XXE Injection Lab

Elliot | Last updated: Mar 25, 2020 12:17PM UTC

I just came across a problem while attempting the first XXE Injection lab. In the first lab, you have to define an entity and use it to retrieve the /etc/passwd file. I submitted the following payload: <?xml version="1.0" encoding="UTF-8"?><!DOCTYPE stockCheck [<!ENTITY xxe SYSTEM "file:///etc/passwd">]><stockCheck><productId>&xxe;</productId><storeId>1</storeId></stockCheck> But I don't get the /etc/passwd file. I checked the solution and I'm sure I'm doing everything correctly (well, I think). The part that confuses me the most is the fact that I still solved the lab :/ What exactly am I doing wrong here?

Michelle, PortSwigger Agent | Last updated: Mar 25, 2020 02:56PM UTC

Did you intercept the response so you could analyze it in Burp?

Elliot | Last updated: Mar 26, 2020 11:51AM UTC

Sorry for the late reply; I analyzed the response in burp and it worked. I wasn't aware it wouldn't work in the browser. Why's that though?

Michelle, PortSwigger Agent | Last updated: Mar 26, 2020 01:36PM UTC