XXE
XML External Entities
0 / 6 solved
Abuse XML parsers to read files and reach internal systems.
Quick reference
XXE cheat sheet
Look for features that parse XML or XML-based file formats, then determine whether external entities are processed.
Where to look
- Endpoints accepting Content-Type: application/xml or text/xml.
- SOAP/XML APIs, XML import/export, configuration uploads, SVG uploads, office/document converters, and feed parsers.
- Burp history is useful for spotting requests whose body begins with <?xml.
Simple checks
- First verify that a custom entity is expanded.
- If it is, test whether an external SYSTEM entity is allowed inside the training target.
- If the response is blind, look for an out-of-band callback or a secondary effect.
<!DOCTYPE r [<!ENTITY test "xxe-check">]><r>&test;</r><!DOCTYPE r [<!ENTITY xxe SYSTEM "file:///etc/hostname">]><r>&xxe;</r>Realistic approach
- Compare normal and modified responses: parser errors often reveal whether DTDs are enabled.
- Try the smallest valid XML document first; malformed XML can hide the real issue.
- For SVG or document uploads, remember the XML may be parsed only after preview, conversion, or server-side processing.
- XXE can sometimes become file disclosure or server-side request forgery depending on parser behavior.