vulns.cofield index
Enter
Contribute
Testing playbook · intermediate

XXE Injection

Abuse XML external entity parsing to read files, perform SSRF, or exfiltrate data out-of-band.

xxexmlssrffile-read
Stable IDplaybook:xxeLast updatedLast verifiedLegacy review pendingProvenanceCurated workflow
Detection firstStop as soon as the evidence decisively supports or falsifies the hypothesis.

Every step requires authorization. Review side effects before running commands against a live system.

01

Find XML sinks

SOAP endpoints, file uploads (DOCX/SVG/XML), and APIs accepting application/xml. Also try switching a JSON endpoint's Content-Type to XML.

Burp Suite
Evidence checkpointSave the request or command, raw result, timestamp, target, and a negative control before continuing.
02

Classic file read

Declare an external entity pointing at a local file and reflect it in the response.

<!DOCTYPE r [<!ENTITY x SYSTEM 'file:///etc/passwd'>]><r>&x;</r>
Evidence checkpointSave the request or command, raw result, timestamp, target, and a negative control before continuing.
03

Blind / OOB

When there's no reflection, use an external DTD on your server to exfiltrate file contents over HTTP/DNS.

interactsh-client -v
interactsh
Evidence checkpointSave the request or command, raw result, timestamp, target, and a negative control before continuing.
04

SSRF via XXE

Point the entity at internal services or cloud metadata to pivot.

Evidence checkpointSave the request or command, raw result, timestamp, target, and a negative control before continuing.
Field notes

Common guidance

  • SVG and Office documents are XML - upload fields are a classic XXE vector.
  • Parameter entities (%) are needed for most blind/OOB exfiltration.
Related tools

Mapped workflow tools

ToolBurp SuiteToolinteractsh
Sources

References

Version history: normalized permanent page created 2026-08-20.