Vulnerability field guide
XML External Entity
An XML parser that resolves external entities will fetch any file or URL an attacker names. Here is how XXE turns a document upload into local file disclosure and SSRF, and the parser settings that stop it cold.
4 articles18 min totalOverview to advanced techniques
Start here
<!ENTITY x SYSTEM "file:///etc/passwd">Step 01 · Start with the overview
XML External Entity3 min read
XML External Entity (XXE): How a Parser Reads /etc/passwd For You
An XML parser that resolves external entities will fetch any file or URL an attacker names. Here is how XXE turns a document upload into local file disclosure and SSRF, and the parser settings that stop it cold.
Read the overviewContinue the field guide
3 focused deep-dives