XXE hunting
A parser that loads a DTD from a URL you control is at least SSRF. Prove the fetch with OAST. Do not point it at metadata or local files first.
Skill
No skill is linked for this class yet. Start with the playbook on this page.
Practice the class in the browser: PortSwigger Web Security Academy. The lab is theirs. This page is the stop condition and the disclosures.
Checklists
None linked for this class yet.
Disclosures
No public card yet.
Playbooks
- XXE Injection - Abuse XML external entity parsing to read files, perform SSRF, or exfiltrate data out-of-band.
Payloads
- XML External Entity - Classic file read via inline entity; blind exfiltration via an external DTD you host. Also works through SVG and Office (docx/xlsx) uploads. Avoid billion-laughs on prod - it's a DoS.
Bypasses
- XXE parser still fetches - Prove the parser resolves an external identifier with a canary. Do not file-read or hit metadata first.
Questions
File read or canary?
Canary first. File read only if policy allows a harmless path, and never other customers' data.
Where does XXE still live?
SAML ACS, OOXML preview, SOAP, SVG, RSS, XML backups. JSON APIs that still accept application/xml.
This page is the linked pack hunt_brief("xxe") returns on the MCP connector. Authorized testing only.