> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/xxe/xxe-reusing-local-dtd-to-extract-data.md).
# 重用本地 DTD 提取数据的 XXE
重用本地 DTD 提取数据的 XXE 笔记，适用于 PortSwigger Web Security Academy 实验室，包括利用流程、载荷测试、Burp Suite 验证和修复上下文。
### 利用 XXE 通过重用本地 DTD 来检索数据
在“检查库存”功能中利用 XXE 漏洞：服务器会扫描 XML，但不会直接显示结果。方法是引用服务器上存在的本地 DTD，并重新定义一个实体以引发包含 `/etc/passwd` 内容的错误。
使用 GNOME 环境的系统通常会在以下位置有一个本地 DTD： `/usr/share/yelp/dtd/docbookx.dtd` 其中定义了一个名为 `ISOamso`。使用这个已存在的 DTD 注入恶意参数实体
强制 XML 解析器生成一个错误，从而泄露 `/etc/passwd` 内容，方法是重新定义本地 DTD 实体。
{% code overflow="wrap" %}
```xml
%myFile;]>
1
1
```
{% endcode %}
之前的尝试会产生服务器端错误。
声明本地 DTD，并且 `ISOamso` 该实体被重新定义，以注入读取 `/etc/passwd` 然后通过一个不存在的实体强制外带，从而引发包含所读取内容的错误。
{% code overflow="wrap" fullWidth="true" %}
```xml
">
%eval;
%exfil;
'>
%local_dtd;
]>
```
{% endcode %}
当包含本地 DTD 且 `ISOamso` 实体如上所述被重新定义后，解析器会尝试解析 `exfil` 指向一个不存在路径的实体（`file:///noexist/...`）。此解析会导致解析器出错，而其跟踪信息中会包含展开结果——也就是 `/etc/passwd` 会出现在服务器返回的错误消息中。
```xml
">
%eval;
%exfil;
'>
%local_dtd;
]>
1
1
```
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://hacking-notes.jord4n.pro/zh/web/xxe/xxe-reusing-local-dtd-to-extract-data.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
