XML External Entity (XXE) Injection
XXE tests whether an XML parser resolves external entities or DTDs supplied by the attacker. The exam expects you to find XML-accepting surfaces, extract files, and pivot to out-of-band exfiltration when output is suppressed.
Core rules and concepts
- Attack surfaces include SOAP endpoints, XML APIs, SVG uploads, DOCX/XLSX files (unzip, edit XML, rezip), SAML assertions, and RSS feeds.
- Classic payload declares
<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>and places&xxe;in a field that the application parses and reflects. - When output is hidden, use parameter entities and an external DTD hosted on your server for out-of-band exfiltration.
- PHP filters such as
php://filter/convert.base64-encode/resource=index.phpavoid breaking XML with raw file characters. - Error-based extraction uses a missing file path to leak directory information.
- XInclude applies when only a fragment is injected:
<xi:include parse="text" href="file:///etc/passwd"/>.
Worked example
POST XML to /api/parse with Content-Type: application/xml; the response echoes the product name. Insert a DOCTYPE defining xxe as file:///etc/passwd and replace the name value with &xxe;. The response returns root:x:0:0, proving entity resolution. Reasoning: the parser resolves the external entity and the application reflects the parsed value. If the reflected value is empty, switch to an external DTD on your listener to capture the file contents out-of-band.
Traps that cost marks
- Not retrying JSON endpoints with an XML body and XML content type.
- Forgetting that file contents can break XML syntax - use base64 filters.
- Assuming disabled general entities also means disabled external DTDs.
- Only testing dedicated XML endpoints while ignoring SVG and DOCX uploads.
- Missing URL-encoding when the XML is passed as a parameter.