xxe

name

xxe

description

XXE/XML technique list -- classic, blind OOB, error-based, parameter entities, billion laughs, XInclude, XSLT, and XXE in SVG/DOCX/XLSX/PPTX/RSS/SOAP formats -- plus the SSRF/file-read/port-scan escalations XXE enables. Converted from master-pentest-prompt.md Phase 11. Use on any endpoint that parses XML, or any file format that's secretly XML internally (SVG, Office Open XML documents, RSS/Atom, SOAP).

XXE / XML (never assume not applicable)

When to use

Any endpoint that explicitly accepts XML, and -- easy to miss -- any file upload accepting a format that's XML under the hood: SVG, DOCX/XLSX/PPTX (Office Open XML), RSS/Atom feeds, SOAP requests. "This API only takes JSON" doesn't rule out an XXE-capable upload feature elsewhere in the same app.

Techniques

• Classic in-band XXE.
• Blind out-of-band (DTD fetched via HTTP/FTP -- oob-mcp for the callback).
• Error-based XXE (forcing a parser error that leaks file content).
• Parameter entities (for cases where the classic general-entity approach is filtered).
• Billion laughs / entity expansion DoS.
• XInclude (works even when external DTDs are blocked).
• XSLT-based attacks.
• Format-specific: SVG, DOCX/XLSX/PPTX, RSS/Atom, SOAP.

Escalations

• SSRF via XXE (see the ssrf skill for the full SSRF technique list once the XML parser is confirmed to fetch external entities).
• File read via XXE.
• Port scan via XXE response-timing differences.