CD Title

Support HackTricks and get benefits!

Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)! Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family) Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) **Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/carlospolopm)**.** **Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**

It is used to transform XML documents in another kind. Versions: 1, 2 and 3 (1 is the most used).\ The transformation can be done in the server or in the browser). The most used frameworks are: **Libxslt** (Gnome), **Xalan** (Apache) and **Saxon** (Saxonica). In order to exploit this kind of vulnerability you need to be able to store xsl tags in the server side and then access that content. An example of this kind of vulnerability can be found on [https://www.gosecure.net/blog/2019/05/02/esi-injection-part-2-abusing-specific-implementations/](https://www.gosecure.net/blog/2019/05/02/esi-injection-part-2-abusing-specific-implementations/) # Example - Tutorial ```markup sudo apt-get install default-jdk sudo apt-get install libsaxonb-java ``` {% code title="xml.xml" %} ```markup CD Title The artist Da Company 10000 1760 ``` {% endcode %} {% code title="xsl.xsl" %} ```markup

The Super title

Title	artist

``` {% endcode %} Execute: ```markup $ saxonb-xslt -xsl:xsl.xsl xml.xml Warning: at xsl:stylesheet on line 2 column 80 of xsl.xsl: Running an XSLT 1.0 stylesheet with an XSLT 2.0 processor

The Super title

Title	artist
CD Title	The artist

``` ## Fingerprint {% code title="detection.xsl" %} ```markup

XSLT identification

Version:

Vendor:

Vendor URL:

``` {% endcode %} And execute ```markup $saxonb-xslt -xsl:detection.xsl xml.xml Warning: at xsl:stylesheet on line 2 column 80 of detection.xsl: Running an XSLT 1.0 stylesheet with an XSLT 2.0 processor

XSLT identification

Version:2.0
Vendor:SAXON 9.1.0.8 from Saxonica
Vendor URL:http://www.saxonica.com/
``` ## Read Local File {% code title="read.xsl" %} ```markup

``` {% endcode %} ```markup $ saxonb-xslt -xsl:read.xsl xml.xml Warning: at xsl:stylesheet on line 1 column 111 of read.xsl: Running an XSLT 1.0 stylesheet with an XSLT 2.0 processor root:x:0:0:root:/root:/bin/bash daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin bin:x:2:2:bin:/bin:/usr/sbin/nologin sys:x:3:3:sys:/dev:/usr/sbin/nologin sync:x:4:65534:sync:/bin:/bin/sync games:x:5:60:games:/usr/games:/usr/sbin/nologin man:x:6:12:man:/var/cache/man:/usr/sbin/nologin lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin ``` ## SSRF ```markup ``` ## Versions There might be more or less functions depending on the XSLT version used: * [https://www.w3.org/TR/xslt-10/](https://www.w3.org/TR/xslt-10/) * [https://www.w3.org/TR/xslt20/](https://www.w3.org/TR/xslt20/) * [https://www.w3.org/TR/xslt-30/](https://www.w3.org/TR/xslt-30/) # Fingerprint Upload this and take information ```markup Version:
Vendor:
Vendor URL:
Product Name:
Product Version:
Is Schema Aware ?:
Supports Serialization:
Supports Backwards Compatibility:
``` # SSRF ```markup ``` # Javascript Injection ```markup ``` # Directory listing (PHP) ## **Opendir + readdir** ```markup

- - - - - - - - -

``` ## **Assert (var_dump + scandir + false)** ```markup

``` # Read files ## **Internal - PHP** ```markup

``` ## **Internal - XXE** ```markup ]> &ext_file; ``` ## **Through HTTP** ```markup

``` ```markup ]> &passwd; ``` ## **Internal (PHP-function)** ```markup

``` ```markup

``` ## Port scan ```markup

``` # Write to a file ## XSLT 2.0 ```markup

Write Local File

``` ## **Xalan-J extension** ```markup Write Local File ``` Other ways to write files in the PDF # Include external XSL ```markup ``` ```markup ``` # Execute code ## **php:function** ```markup

``` ```markup

``` Execute code using other frameworks in the PDF ## **More Languages** **In this page you can find examples of RCE in other languajes: **[**https://vulncat.fortify.com/en/detail?id=desc.dataflow.java.xslt_injection#C%23%2FVB.NET%2FASP.NET**](https://vulncat.fortify.com/en/detail?id=desc.dataflow.java.xslt_injection#C%23%2FVB.NET%2FASP.NET)** (C#, Java, PHP)** # **Access PHP static functions from classes** The following function will call the static method `stringToUrl` of the class XSL: ```markup

``` (Example from [http://laurent.bientz.com/Blog/Entry/Item/using_php_functions_in_xsl-7.sls](http://laurent.bientz.com/Blog/Entry/Item/using_php_functions_in_xsl-7.sls)) # **Brute-Force Detection List** {% embed url="https://github.com/carlospolop/Auto_Wordlists/blob/main/wordlists/xslt.txt" %} # **References** * [XSLT_SSRF](https://feelsec.info/wp-content/uploads/2018/11/XSLT_SSRF.pdf)\ * [http://repository.root-me.org/Exploitation%20-%20Web/EN%20-%20Abusing%20XSLT%20for%20practical%20attacks%20-%20Arnaboldi%20-%20IO%20Active.pdf](http://repository.root-me.org/Exploitation%20-%20Web/EN%20-%20Abusing%20XSLT%20for%20practical%20attacks%20-%20Arnaboldi%20-%20IO%20Active.pdf)\ * [http://repository.root-me.org/Exploitation%20-%20Web/EN%20-%20Abusing%20XSLT%20for%20practical%20attacks%20-%20Arnaboldi%20-%20Blackhat%202015.pdf](http://repository.root-me.org/Exploitation%20-%20Web/EN%20-%20Abusing%20XSLT%20for%20practical%20attacks%20-%20Arnaboldi%20-%20Blackhat%202015.pdf)

Support HackTricks and get benefits!