> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/web/xxe/xxe-reusing-local-dtd-to-extract-data.md).
# XXE Reusing a Local DTD to Extract Data
XXE Reusing a Local DTD to Extract Data notes for PortSwigger Web Security Academy labs, including exploitation workflow, payload testing, Burp Suite validation, and remediation context.
### Exploiting XXE to Retrieve Data by Repurposing a Local DTD
Operating a XXE vulnerability on Check stock functionality: the server scans XML but does not show the result directly. The approach is to refer to a local DTD present on the server and redefine an entity to cause an error containing `/etc/passwd` content.
Systems using the GNOME environment often have a local DTD located at `/usr/share/yelp/dtd/docbookx.dtd` that defines an entity named `ISOamso`. Using this already present DTD to inject malicious parametric entities
Force the XML parser to generate an error that discloses `/etc/passwd` content by redefining a local DTD entity.
{% code overflow="wrap" %}
```xml
%myFile;]>
1
1
```
{% endcode %}
The previous attempt produces a server-side error.
The local DTD is declared and the `ISOamso` entity is redefined to inject parametric entities that read `/etc/passwd` and then force an exfiltration by a non-existent entity to cause an error containing the read content.
{% code overflow="wrap" fullWidth="true" %}
```xml
">
%eval;
%exfil;
'>
%local_dtd;
]>
```
{% endcode %}
When the local DTD is included and the `ISOamso` entity is redefined as above, the parser attempts to resolve the `exfil` entity pointing to a non-existing path (`file:///noexist/...`). This resolution causes an error of the parser which, in its trace, includes the result of expansion — that is, the content of `/etc/passwd` appears in the error message returned by the server.
```xml
">
%eval;
%exfil;
'>
%local_dtd;
]>
1
1
```
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://hacking-notes.jord4n.pro/web/xxe/xxe-reusing-local-dtd-to-extract-data.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
