# XSLT Server Side Injection \(Extensible Stylesheet Languaje Transformations\)
It is used to transform XML documents in another kind. Versions: 1, 2 and 3 \(1 is the most used\).
The transformation can be done in the server or in the browser\).
The most used frameworks are: **Libxslt** \(Gnome\), **Xalan** \(Apache\) and **Saxon** \(Saxonica\).
In order to exploit this kind of vulnerability you need to be able to store xsl tags in the server side and then access that content. An example of this kind of vulnerability can be found on [https://www.gosecure.net/blog/2019/05/02/esi-injection-part-2-abusing-specific-implementations/](https://www.gosecure.net/blog/2019/05/02/esi-injection-part-2-abusing-specific-implementations/)
## Fingerprint
Upload this and take information
```markup
Version:
Vendor:
Vendor URL:
Product Name:
Product Version:
Is Schema Aware ?:
Supports Serialization:
Supports Backwards Compatibility:
```
## External HTTP Request
```markup
```
## Javascript Injection
```markup
```
## Directory listing \(PHP\)
### **Opendir + readdir**
```markup
-
-
-
-
-
-
-
-
-
```
### **Assert \(var\_dump + scandir + false\)**
```markup
```
## Read files
### **Internal**
```markup
]>
&ext_file;
```
### **Through HTTP**
```markup
```
```markup
]>
&passwd;
```
### **Internal \(PHP\)**
```markup
```
```markup
```
### Port scan
```markup
```
## Write to a file
### XSLT 2.0
```markup
Write Local File
```
### **Xalan-J extension**
```markup
Write Local File
```
Other ways to write files in the PDF
## Include external XSL
```markup
```
```markup
```
## Execute code
### **php:function**
```markup
```
```markup
```
Execute code using other frameworks in the PDF
### **More Languages**
**In this page you can find examples of RCE in other languajes:** [**https://vulncat.fortify.com/en/detail?id=desc.dataflow.java.xslt\_injection\#C%23%2FVB.NET%2FASP.NET**](https://vulncat.fortify.com/en/detail?id=desc.dataflow.java.xslt_injection#C%23%2FVB.NET%2FASP.NET) **\(C\#, Java, PHP\)**
## **References**
* [XSLT\_SSRF](https://feelsec.info/wp-content/uploads/2018/11/XSLT_SSRF.pdf)
* [http://repository.root-me.org/Exploitation%20-%20Web/EN%20-%20Abusing%20XSLT%20for%20practical%20attacks%20-%20Arnaboldi%20-%20IO%20Active.pdf](http://repository.root-me.org/Exploitation%20-%20Web/EN%20-%20Abusing%20XSLT%20for%20practical%20attacks%20-%20Arnaboldi%20-%20IO%20Active.pdf)
* [http://repository.root-me.org/Exploitation%20-%20Web/EN%20-%20Abusing%20XSLT%20for%20practical%20attacks%20-%20Arnaboldi%20-%20Blackhat%202015.pdf](http://repository.root-me.org/Exploitation%20-%20Web/EN%20-%20Abusing%20XSLT%20for%20practical%20attacks%20-%20Arnaboldi%20-%20Blackhat%202015.pdf)