Skip to content
SelfSec
Join the launch listLaunch list
SelfSec
Vulnerability field guide

XML External Entity

An XML parser that resolves external entities will fetch any file or URL an attacker names. Here is how XXE turns a document upload into local file disclosure and SSRF, and the parser settings that stop it cold.

4 articles 18 min total Overview to advanced techniques

Start with the overview

XML External Entity3 min read

XML External Entity (XXE): How a Parser Reads /etc/passwd For You

An XML parser that resolves external entities will fetch any file or URL an attacker names. Here is how XXE turns a document upload into local file disclosure and SSRF, and the parser settings that stop it cold.

Read the overview

XML External Entity techniques

3 focused deep-dives
  1. 02 Blind / Out-of-BandBlind XXE: Exfiltrating Files With Out-of-Band Parameter Entities 5 min
  2. 03 Denial of ServiceBillion Laughs: Denial of Service Through XML Entity Expansion 5 min
  3. 04 File-Backed FormatsXXE in File Uploads: SVG, DOCX and Other XML-Backed Formats 5 min