Web Application Hacking (Hands-On)

XXE Injection — Concept + Live Lab

Abuse XML external entities to read server files.

Advanced · 15 min · Hands-on lab

Open the interactive lesson & lab →

XML External Entity (XXE) injection targets XML parsers that resolve external entities. XML lets a document define entities — shortcuts — and an external entity can point at a file or URL. If the parser resolves it, you can read local files or trigger SSRF.

<?xml version="1.0"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<order><item>&xxe;</item></order>

The parser replaces &xxe; with the contents of /etc/passwd, embedding the file in the response. Anywhere an app accepts XML (SOAP APIs, SAML, file uploads, config imports) is a candidate.

• File disclosure — read /etc/passwd, config files, source code.
• SSRF — point the entity at an internal http:// URL.
• Blind XXE — exfiltrate data out-of-band when output isn't reflected.

Take the quiz and try the live lab →