By name: xxe description: Hunt XML External Entity flaws in parsers and validate file read / SSRF impact with strict negative controls. metadata: subdomain: web-exploitation when_to_use: "xxe xml external entity parser file read ssrf cwe-611 dtd parameter entity blind oob"
XXE Playbook
Find parser sinks
- Java:
DocumentBuilderFactory,SAXParserFactory,XMLInputFactory - Python:
lxml.etree,xml.dom.minidom,xml.sax - .NET:
XmlDocument,XDocument,XmlReader
Dangerous defaults
- DTD enabled
- External entities enabled
- Network/file entity resolution enabled
Payloads
- File read: entity to
file:///etc/passwd - SSRF: entity to internal URL (metadata service, localhost admin)
Validation
- Positive: parser output contains file content or internal response markers.
- Negative: same XML without entity expansion must not leak content.