Extracting server files using XXE vulnerabilities

XXE is a vulnerability that affects an application that parses XML and made a mistaking when parsing an XML that has reference to an XXE.

Exploiting the vulnerability

Imagine we have an application susceptible to an XXE vulnerability, where we have a vulnerable request as shown in the following screenshot:

Here, the xmlparameter is vulnerable to an XXE and the header, as shown in the following block:

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 

It means that this is a request that is accepting XML as the input. So, we will modify the input using the Burp Suite's Proxy, to see if the application is accepting our testing string. To do this, we are going to use the following input:

<!DOCTYPE foo [ <!ELEMENT  ANY> <!ENTITY bar "cosa">  <!ENTITY barxee "&amp;bar; XEE" > ]> <foo> &amp;barxee; </foo> 

If it's accepted, the application will show the message that we are passing in the...