# XSLT Server Side Injection (Extensible Stylesheet Languaje Transformations)
It is used to transform XML documents in another kind. Versions: 1, 2 and 3 (1 is the most used).\
The transformation can be done in the server or in the browser).
The most used frameworks are: **Libxslt** (Gnome), **Xalan** (Apache) and **Saxon** (Saxonica).
In order to exploit this kind of vulnerability you need to be able to store xsl tags in the server side and then access that content. An example of this kind of vulnerability can be found on
## Fingerprint
Upload this and take information
```markup
Version:
Vendor:
Vendor URL:
Product Name:
Product Version:
Is Schema Aware ?:
Supports Serialization:
Supports Backwards Compatibility:
```
## External HTTP Request
```markup
```
## Javascript Injection
```markup
```
## Directory listing (PHP)
### **Opendir + readdir**
```markup
-
-
-
-
-
-
-
-
-
```
### **Assert (var\_dump + scandir + false)**
```markup
```
## Read files
### **Internal**
```markup
]>
&ext_file;
```
### **Through HTTP**
```markup
```
```markup
]>
&passwd;
```
### **Internal (PHP)**
```markup
```
```markup
```
### Port scan
```markup
```
## Write to a file
### XSLT 2.0
```markup
Write Local File
```
### **Xalan-J extension**
```markup
Write Local File
```
Other ways to write files in the PDF
## Include external XSL
```markup
```
```markup
```
## Execute code
### **php:function**
```markup
```
```markup
```
Execute code using other frameworks in the PDF
### **More Languages**
**In this page you can find examples of RCE in other languajes:** [**https://vulncat.fortify.com/en/detail?id=desc.dataflow.java.xslt\_injection#C%23%2FVB.NET%2FASP.NET**](https://vulncat.fortify.com/en/detail?id=desc.dataflow.java.xslt_injection#C%23%2FVB.NET%2FASP.NET) **(C#, Java, PHP)**
## **References**
* [XSLT\_SSRF](https://feelsec.info/wp-content/uploads/2018/11/XSLT_SSRF.pdf)
*
*
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter:
```
GET https://chinnidiwakar.gitbook.io/githubimport/pentesting-web/xslt-server-side-injection-extensible-stylesheet-languaje-transformations.md?ask=
```
The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.