Solving Portswigger Academy: Exploiting XInclude to retrieve files

This lab has a “Check stock” feature that embeds the user input inside a server-side XML document that is subsequently parsed.

Because you don’t control the entire XML document you can’t define a DTD to launch a classic XXE attack.

To solve the lab, inject an XInclude statement to retrieve the contents of the /etc/passwd file.

Access the lab and click on view details of any product. After that click on check stock.When you check the request you will notice it did not contain XML this time.

Now let’s check if we can change it to XML and it is processed by the server.It did not work.

Let’s change our attack using Xinclude. It looks like the application is looking for productID. Let’s use belpw payload in Product ID.

You will notice our attack is successful.

Let’s remove the parse from above payload to test what happen.So when we remove it we receive error in response.