Lab: Exploiting XXE to retrieve data by repurposing a local DTD
Summary: This PortSwigger lab presents a "Check stock" feature that parses XML input without displaying the result, and asks the solver to trigger an error message containing the contents of the /etc/passwd file. The solution requires referencing an existing DTD on the server and redefining an entity from it, using the docbookx.dtd file at /usr/share/yelp/dtd/docbookx.dtd on systems running the GNOME desktop environment, which contains an entity called ISOamso.
What you should know: The attack path depends on a file that ships by default with GNOME, so a server-side XML parser that resolves external entities can be turned against data like /etc/passwd without any custom component on the host.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026