XXE learning path

Orientation and first principles — what the bug class is and how it behaves.

1. XXE Vulnerability Guide 2025: How XML Attacks Still Threaten
   12 min readinstatunnel.my2026
   Library of techniques and code examples for understanding and mitigating XML External Entity (XXE) vulnerabilities, which continue to threaten modern applications in 2025. This resource covers file disclosure attacks, server-side request forgery (SSRF), and denial-of-service exploits like the "Billion Laughs" attack, highlighting their relevance in SOAP APIs, file upload features with SVG, and legacy systems. Specific examples of vulnerable systems include Akamai CloudTest (CVE-2025-49493) and Ambari/Oozie (CVE-2025-23195), demonstrating how attackers can access sensitive files and internal network resources.
2. XML External Entity (XXE) Attack Guide | Hackviser
   7 min readhackviser.com2026
   Guide to XML External Entity (XXE) attacks, detailing manual testing techniques for identifying vulnerabilities in various XML inputs, including file uploads and SOAP requests. It covers exploitation methods such as local file disclosure, server-side request forgery (SSRF) via HTTP callbacks and PHP wrappers, denial of service attacks like the "Billion Laughs" attack, and automated discovery using tools like Burp Suite, XXEinjector, and Nuclei.
3. XML External Entity: The Ultimate Bug Bounty Guide to XXE | YesWeHack
   18 min readyeswehack.com2026
   Guide to XML External Entity (XXE) vulnerabilities, this resource details how attackers exploit XML parsers to access sensitive files like /etc/passwd, conduct internal network reconnaissance, and even achieve remote code execution. It covers how XXE attacks leverage external entity declarations within XML input, leading to file disclosure, Server-Side Request Forgery (SSRF), and denial-of-service. The guide explains that XXE often arises from legacy code, explicit feature enablement, or custom configurations in parsers used in document processing systems (DOCX, XLSX), API endpoints, SOAP services, and SVG processors.
4. What is a Blind XXE Attack? | PortSwigger
   7 min readportswigger.net2026
   Reference detailing techniques for finding and exploiting blind XXE vulnerabilities. It describes how these attacks, where the application doesn't return entity values directly, can be overcome using out-of-band (OAST) methods to detect them or by triggering XML parsing errors that exfiltrate sensitive data from files like `/etc/passwd` via HTTP requests or error messages. The guide also covers using XML parameter entities and repurposing local DTDs for exploitation.
5. https://gosecure.github.io/xxe-workshop/#0
   14 min readgosecure.github.io2025
   Workshop slides detailing XML External Entity (XXE) exploitation techniques for PHP and Java applications. This resource covers identifying XXE vulnerabilities and converting them into directory listing, file exfiltration, file write, and remote code execution via classic XML patterns, out-of-band DTD techniques, and FTP/Gopher protocols. It includes four lab applications, sample payloads, and Docker recipes for deployment.

Real testing methodology, tooling, and writeups that show the work.

1. The File That Answered Back — XXE Hidden in Cell A2
   10 min readinfosecwriteups.com2026
   Writeup detailing an XML External Entity (XXE) vulnerability discovered in an Excel file upload endpoint. The exploit bypasses Imperva WAF rules by hiding the `DOCTYPE` declaration within the XML structure of an `.xlsx` file, which is essentially a ZIP archive containing XML documents. The writeup explains how to manually construct a valid XLSX file with a malicious XML parser instruction to read server-side files, ultimately returning sensitive data within the application's JSON response.
2. Blind XXE Attacks: Out of Band Interaction Techniques to Exfiltrate Data
   5 min readshreyapohekar.com2026
   Technique for blind XXE attacks that describes using Out-of-Band Application Security Testing (OAST) to exfiltrate data. It details how to craft malicious DTDs and leverage XML parameter entities, including techniques for extracting data via HTTP requests, FTP, and handling unparsable XML files using CDATA sections. The writeup references Burp Collaborator for OAST interactions and PortSwigger labs for practical application.
3. Hunting in the Dark - Blind XXE
   11 min readblog.zsec.uk2025
   Writeup detailing blind XXE attacks against a JSON endpoint that parses XML content. The author demonstrates how to identify XML processing by altering the `Content-Type` header and uses error-based responses to perform port scanning on the backend. Techniques explored include exploiting Java-based `UnmarshalException` errors and utilizing Server Side Request Forgery (SSRF) to probe open ports like 8080.
4. https://www.noob.ninja/2019/12/spilling-local-files-via-xxe-when-http.html
   5 min readnoob.ninja2025
   Writeup detailing XXE exploitation when HTTP Out-of-Band is blocked, utilizing verbose XML parsing errors to exfiltrate local files. It covers bypassing Cloudflare WAF by omitting XML declarations and adding spaces to file protocols, and then explores advanced techniques like exploiting local DTDs found with tools like GoSecure's `dtd-finder` to overwrite existing entities. The exploit leverages the `jar` protocol on Java applications to read files from archives and inject them into error messages, revealing sensitive data like `/etc/passwd`.
5. XXE - Things Are Getting Out of Band
   7 min readblog.zsec.uk2025
   Library for out-of-band XXE attacks, detailing data exfiltration techniques via FTP and HTTP. It covers exploiting vulnerable Java and ASP.NET applications, demonstrating how to craft XML payloads to trigger external requests for sensitive file contents like `/etc/passwd`. The library also briefly touches upon RCE via XXE in ASP.NET by downloading a webshell.

Novel research, edge cases, and the techniques that push the class forward.

1. Blind XXE: Exfiltrating Data Out-of-Band in 2025
   7 min readinstatunnel.my2026
   Library for demonstrating and exploiting Blind XXE vulnerabilities, where applications don't reflect external entity values in responses. This library covers out-of-band data exfiltration techniques using parameter entities and malicious DTDs, error-based exploitation, and exploiting local DTD files. It also touches on protocol handlers like FTP for data exfiltration, HTTP/HTTPS for SSRF, and various `file://` protocol variations. Real-world scenarios like internal network reconnaissance, cloud metadata exploitation, and targeting database configuration files are discussed, along with mentions of vulnerabilities like CVE-2024-5919 in Palo Alto Networks PAN-OS.
2. XXE Injection: Advanced Exploitation Guide
   8 min readintigriti.com2026
   Guide to exploiting advanced XML External Entity (XXE) vulnerabilities, covering identification and exploitation techniques. The guide details common vulnerable components, simple XXE to SSRF attacks, bypassing filters with external DTDs and parameter entities, and resource exhaustion via the 'Billion Laughs' attack. It also touches upon UTF-7 encoding as a potential evasion method.
3. Advanced XXE Exploitation: File Disclosure, Blind OOB, and RCE
   3 min readgithub.com2026
   Writeup detailing advanced XML External Entity (XXE) exploitation techniques, including local file disclosure of sensitive files like `/etc/passwd` and `config.php`, bypassing character restrictions with PHP filters for Base64 encoding, and achieving blind XXE via DNS and HTTP exfiltration. The writeup further demonstrates escalating XXE to Remote Code Execution (RCE) on misconfigured PHP servers utilizing the `expect://` wrapper for command execution and establishing persistence with a reverse shell.
4. Comprehensive Guide to XXE Exploitation: Advanced Data Exfiltration and RCE
   5 min readnullsecurityx.codes2026
   Guide to XXE Exploitation details advanced techniques for exploiting XML External Entity vulnerabilities. It covers identifying vulnerable XML endpoints using tools like Burp Suite, testing for basic XXE, and bypassing input validation with `php://filter`. The guide demonstrates blind XXE via HTTP and DNS out-of-band exfiltration, and outlines methods to achieve Remote Code Execution (RCE) using wrappers like `expect://` and deploying web shells. Specific vulnerabilities discussed include information disclosure (CWE-200) and SSRF.
5. From blind XXE to root-level file read access – Honoki
   10 min readhonoki.net2025
   Writeup detailing blind XXE exploitation, focusing on error message analysis to identify the Java SAX Parser and infer firewall behavior. The technique successfully enumerated internal services and reached internal applications like wiki.company.internal, demonstrating how to elevate a medium-criticality XXE vulnerability to a critical finding.
6. Pre-auth XXE → HTTP SSRF on ArubaOS 8.13.2 closed as "theoretical / no valid PoC" despite TCP pcap, sshd localhost log, and internal port scan — documenting for community review
   2 min readnetacoding.com2026
   Writeup detailing pre-authentication XXE leading to Out-of-Band (OOB) SSRF on ArubaOS 8.13.2.0. This vulnerability allows attackers to force outbound HTTP connections, probe internal network services, and resolve external DTDs, evidenced by packet captures, daemon logs, and internal port scans. Despite this proof, the submission was closed by HPE Networking as "theoretical / no valid PoC" on Bugcrowd.
7. A Deep Dive Into XXE Injection (Synack)
   9 min readsynack.com2026
   Library detailing XML External Entity (XXE) injection, a prevalent vulnerability found anywhere an XML parser exists, not just web applications. It explains how ENTITYs within Document Type Definitions (DTDs) can be manipulated, even via POST requests intercepted with tools like Burpsuite, to exfiltrate local files such as `/etc/passwd` or use out-of-band techniques with external DTDs.
8. Advanced XXE Exploitation: File Disclosure, Blind OOB, and RCE
   3 min readgithub.com2026
   Writeup detailing advanced XML External Entity (XXE) exploitation techniques including local file disclosure for sensitive data like `/etc/passwd` and `config.php`, bypassing character restrictions with `php://filter` and Base64 encoding, performing blind XXE via DNS and HTTP out-of-band (OOB) exfiltration, and achieving remote code execution (RCE) on misconfigured PHP servers using the `expect://` wrapper, as demonstrated on a target.com endpoint.