# XSLT Server Side Injection (Extensible Stylesheet Languaje Transformations) {% hint style="success" %} Leer & oefen AWS Hacking:[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)\ Leer & oefen GCP Hacking: [**HackTricks Training GCP Red Team Expert (GRTE)**](https://training.hacktricks.xyz/courses/grte)
Support HackTricks * Kyk na die [**subskripsie planne**](https://github.com/sponsors/carlospolop)! * **Sluit aan by die** 💬 [**Discord groep**](https://discord.gg/hRep4RUj7f) of die [**telegram groep**](https://t.me/peass) of **volg** ons op **Twitter** 🐩 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.** * **Deel hacking truuks deur PRs in te dien na die** [**HackTricks**](https://github.com/carlospolop/hacktricks) en [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
{% endhint %} ## Basic Information XSLT is 'n tegnologie wat gebruik word om XML-dokumente in verskillende formate te transformeer. Dit kom in drie weergawes: 1, 2, en 3, met weergawe 1 wat die mees algemeen gebruikte is. Die transformasieproses kan of op die bediener of binne die blaaiers uitgevoer word. Die raamwerke wat die meeste gebruik word, sluit in: - **Libxslt** van Gnome, - **Xalan** van Apache, - **Saxon** van Saxonica. Vir die uitbuiting van kwesbaarhede wat met XSLT geassosieer word, is dit nodig dat xsl-tags aan die bedienerkant gestoor word, gevolg deur toegang tot daardie inhoud. 'n Voorbeeld van so 'n kwesbaarheid is gedokumenteer in die volgende bron: [https://www.gosecure.net/blog/2019/05/02/esi-injection-part-2-abusing-specific-implementations/](https://www.gosecure.net/blog/2019/05/02/esi-injection-part-2-abusing-specific-implementations/). ## Example - Tutorial ```bash sudo apt-get install default-jdk sudo apt-get install libsaxonb-java libsaxon-java ``` {% code title="xml.xml" %} ```xml CD Title The artist Da Company 10000 1760 ``` {% endcode %} {% code title="xsl.xsl" %} ```xml

The Super title

Title artist
``` {% endcode %} Voer uit: ```xml saxonb-xslt -xsl:xsl.xsl xml.xml Warning: at xsl:stylesheet on line 2 column 80 of xsl.xsl: Running an XSLT 1.0 stylesheet with an XSLT 2.0 processor

The Super title

Title artist
CD Title The artist
``` ### Vingerafdruk {% code title="detection.xsl" %} ```xml Version:
Vendor:
Vendor URL:
Product Name:
Product Version:
Is Schema Aware ?:
Supports Serialization:
Supports Backwards Compatibility:
``` {% endcode %} En voer uit ```xml $saxonb-xslt -xsl:detection.xsl xml.xml Warning: at xsl:stylesheet on line 2 column 80 of detection.xsl: Running an XSLT 1.0 stylesheet with an XSLT 2.0 processor

XSLT identification

Version:2.0
Vendor:SAXON 9.1.0.8 from Saxonica
Vendor URL:http://www.saxonica.com/
``` ### Lees Plaaslike LĂȘer {% code title="read.xsl" %} ```xml ``` {% endcode %} ```xml $ saxonb-xslt -xsl:read.xsl xml.xml Warning: at xsl:stylesheet on line 1 column 111 of read.xsl: Running an XSLT 1.0 stylesheet with an XSLT 2.0 processor root:x:0:0:root:/root:/bin/bash daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin bin:x:2:2:bin:/bin:/usr/sbin/nologin sys:x:3:3:sys:/dev:/usr/sbin/nologin sync:x:4:65534:sync:/bin:/bin/sync games:x:5:60:games:/usr/games:/usr/sbin/nologin man:x:6:12:man:/var/cache/man:/usr/sbin/nologin lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin ``` ### SSRF ```xml ``` ### Weergawes Daar mag meer of minder funksies wees, afhangende van die XSLT-weergawes wat gebruik word: * [https://www.w3.org/TR/xslt-10/](https://www.w3.org/TR/xslt-10/) * [https://www.w3.org/TR/xslt20/](https://www.w3.org/TR/xslt20/) * [https://www.w3.org/TR/xslt-30/](https://www.w3.org/TR/xslt-30/) ## Vingerafdruk Laai dit op en neem inligting ```xml Version:
Vendor:
Vendor URL:
Product Name:
Product Version:
Is Schema Aware ?:
Supports Serialization:
Supports Backwards Compatibility:
``` ## SSRF ```xml ``` ## Javascript Inspuiting ```xml ``` ## Gidslys (PHP) ### **Opendir + readdir** ```xml - - - - - - - - - ``` ### **Assert (var\_dump + scandir + vals)** ```xml
``` ## Lees lĂȘers ### **Intern - PHP** ```xml ``` ### **Intern - XXE** ```xml ]> &ext_file; ``` ### **Deur HTTP** ```xml ``` ```xml ]> &passwd; ``` ### **Intern (PHP-funksie)** ```xml ``` ```xml
``` ### Poort skandering ```xml ``` ## Skryf na 'n lĂȘer ### XSLT 2.0 ```xml Write Local File ``` ### **Xalan-J uitbreiding** ```xml Write Local File ``` Ander maniere om lĂȘers in die PDF te skryf ## Sluit eksterne XSL in ```xml ``` ```xml ``` ## Voer kode uit ### **php:function** ```xml ``` ```xml
``` Executeer kode met ander raamwerke in die PDF ### **Meer Tale** **Op hierdie bladsy kan jy voorbeelde van RCE in ander tale vind:** [**https://vulncat.fortify.com/en/detail?id=desc.dataflow.java.xslt\_injection#C%23%2FVB.NET%2FASP.NET**](https://vulncat.fortify.com/en/detail?id=desc.dataflow.java.xslt\_injection#C%23%2FVB.NET%2FASP.NET) **(C#, Java, PHP)** ## **Toegang tot PHP statiese funksies vanaf klasse** Die volgende funksie sal die statiese metode `stringToUrl` van die klas XSL aanroep: ```xml ``` (Example from [http://laurent.bientz.com/Blog/Entry/Item/using\_php\_functions\_in\_xsl-7.sls](http://laurent.bientz.com/Blog/Entry/Item/using\_php\_functions\_in\_xsl-7.sls)) ## More Payloads * Check [https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/XSLT%20Injection](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/XSLT%20Injection) * Check [https://vulncat.fortify.com/en/detail?id=desc.dataflow.java.xslt_injection](https://vulncat.fortify.com/en/detail?id=desc.dataflow.java.xslt_injection) ## **Brute-Force Detection List** {% embed url="https://github.com/carlospolop/Auto_Wordlists/blob/main/wordlists/xslt.txt" %} ## **References** * [XSLT\_SSRF](https://feelsec.info/wp-content/uploads/2018/11/XSLT\_SSRF.pdf)\\ * [http://repository.root-me.org/Exploitation%20-%20Web/EN%20-%20Abusing%20XSLT%20for%20practical%20attacks%20-%20Arnaboldi%20-%20IO%20Active.pdf](http://repository.root-me.org/Exploitation%20-%20Web/EN%20-%20Abusing%20XSLT%20for%20practical%20attacks%20-%20Arnaboldi%20-%20IO%20Active.pdf)\\ * [http://repository.root-me.org/Exploitation%20-%20Web/EN%20-%20Abusing%20XSLT%20for%20practical%20attacks%20-%20Arnaboldi%20-%20Blackhat%202015.pdf](http://repository.root-me.org/Exploitation%20-%20Web/EN%20-%20Abusing%20XSLT%20for%20practical%20attacks%20-%20Arnaboldi%20-%20Blackhat%202015.pdf) {% hint style="success" %} Leer & oefen AWS Hacking:[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)\ Leer & oefen GCP Hacking: [**HackTricks Training GCP Red Team Expert (GRTE)**](https://training.hacktricks.xyz/courses/grte)
Support HackTricks * Check the [**subscription plans**](https://github.com/sponsors/carlospolop)! * **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐩 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.** * **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
{% endhint %}