xml external entity injection
xml external entity injection
An XML parser that resolves external entities will read local files, hit internal services, or open a remote DTD channel for blind exfiltration.
← all categories
XXE happens when an application parses XML with an entity-resolving parser and trusts user-supplied
documents. An attacker defines an external entity that references file://, http://internal/, or
a remote DTD, and the parser dutifully fetches it.
The labs cover classic file read, blind XXE via out-of-band exfiltration, error-based extraction, SSRF pivoting through XML, and parser-specific quirks across libxml, .NET, Java, and Python.
// labs
0 live · 0 total> no labs in this category yet, still cooking.