Web › Module 4 › Lesson 2
XXE Injection
XML External Entity attacks—when parsers resolve entities and leak files or hit internal URLs
Visual · web_developer
XXE abuses XML parsers that expand external entities—reading local files, causing SSRF, or blowing up memory with billion-laughs payloads.
Opening
XML can include more than tags
Developers think of XML as structured data. Parsers can also resolve entities—shortcuts that pull in other text, even from disk or the network. If your API accepts XML uploads or SOAP bodies with a legacy parser, an attacker may read /etc/passwd or scan internal hosts—without a classic SQLi string.
1. External Entities 101
An XML document can declare an entity: <!DOCTYPE foo [ <!ENTITY xxe SYSTEM "file:///etc/passwd"> ]> When the parser expands &xxe; in the document body, it may embed the file contents into the XML tree—which then gets reflected in an error message, logged, or returned to the client.
2. XXE Impact
File disclosure
Read app config, keys, or system files via file:// entities.
SSRF
Entity SYSTEM points to http://internal-host/ instead of a file.
Denial of service
Billion laughs—nested entities that expand exponentially.
3. Classic Lab Payload (Educational)
XXE file read — test only on your own vulnerable parser<?xml version="1.0"?> <!DOCTYPE data [ <!ENTITY xxe SYSTEM "file:///etc/hostname"> ]> <user> <name>&xxe;</name> </user>
<?xml version="1.0"?> <!DOCTYPE data [ <!ENTITY xxe SYSTEM "file:///etc/hostname"> ]> <user> <name>&xxe;</name> </user>
Disable DTDs and external entities
Prefer JSON for new APIs. If XML is required, use parsers with DTD processing off, disable external entity resolution, and keep libraries patched. Validate input size before parsing.
Knowledge Check
XXE abuses:
Multiple choice
Knowledge Check
True or False: XXE can lead to local file read on a vulnerable server.
True or False
Knowledge Check
“Billion laughs” is an XXE technique for:
Multiple choice