> For the complete documentation index, see [llms.txt](https://pwc-3.gitbook.io/pwc/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://pwc-3.gitbook.io/pwc/ji-shu/webpentest2/untitled-31.md).
# XSLT Server Side Injection (Extensible Stylesheet Languaje Transformations)
It is used to transform XML documents in another kind. Versions: 1, 2 and 3 (1 is the most used). The transformation can be done in the server or in the browser).
The most used frameworks are: **Libxslt** (Gnome), **Xalan** (Apache) and **Saxon** (Saxonica).
In order to exploit this kind of vulnerability you need to be able to store xsl tags in the server side and then access that content. An example of this kind of vulnerability can be found on
## Fingerprint
Upload this and take information
```
Version:
Vendor:
Vendor URL:
Product Name:
xsl:if> Product Version:
xsl:if> Is Schema Aware ?:
xsl:if> Supports Serialization:
xsl:if> Supports Backwards Compatibility:
xsl:if>xsl:template>xsl:stylesheet>
```
## External HTTP Request
```
esi:include>
```
## Javascript Injection
```