The newest XML External Entity Processing (XXE) resources are on the XML External Entity Processing (XXE) page. For a reading order instead of a date order, see the XML External Entity Processing (XXE) learning path.
| Date Added | Link | Excerpt |
|---|---|---|
| 2025-08-14 2025 | Burp Suite for Pentester: HackBar intermediate 9 min read Burp XSS | Library for Burp Suite that accelerates manual penetration testing by offering pre-defined payloads for common vulnerabilities. HackBar integrates with Burp Suite's Repeater and Proxy tabs, providing dropdown lists of attack strings for SQL Injection, Cross-Site Scripting (XSS), Local File Inclusion (LFI), XXE Injection, and OS Command Injection, significantly reducing the time spent on manual payload insertion and testing against applications like bWAPP and Acunetix. |
| 2025-08-14 2025 | Advanced XXE Exploitation beginner 14 min read | Workshop slides detailing XML External Entity (XXE) exploitation techniques for PHP and Java applications. This resource covers identifying XXE vulnerabilities and converting them into directory listing, file exfiltration, file write, and remote code execution via classic XML patterns, out-of-band DTD techniques, and FTP/Gopher protocols. It includes four lab applications, sample payloads, and Docker recipes for deployment. |
| 2025-08-14 2025 | XXE-study/xxe.php at master · HLOverflow/XXE-study intermediate | The content refers to a file named "xxe.php" within the "XXE-study" repository on GitHub owned by "HLOverflow." This file is located in the "master" branch of the repository. The term "XXE" likely stands for XML External Entity, a type of security vulnerability. |
| 2025-08-14 2025 | XXE - XEE - XML External Entity - HackTricks beginner 20 min read | Library detailing XML External Entity (XXE) vulnerabilities. It explains XML entities, DTDs, and custom/external entity definitions, highlighting how parsers can be exploited. The resource covers techniques for detecting XXE using parameter entities, including out-of-band detection methods and attempts to read local files like `/etc/passwd` and `C:\windows\system32\drivers\etc\hosts`. It also demonstrates advanced exfiltration strategies using malicious external DTDs to send file contents via HTTP requests or display them within error messages, and explores XXE for SSRF attacks against cloud metadata endpoints. → book.hacktricks.xyz |
| 2025-08-14 2025 | Spilling Local Files via XXE When HTTP OOB Fails intermediate 5 min read | Writeup detailing XXE exploitation when HTTP Out-of-Band is blocked, utilizing verbose XML parsing errors to exfiltrate local files. It covers bypassing Cloudflare WAF by omitting XML declarations and adding spaces to file protocols, and then explores advanced techniques like exploiting local DTDs found with tools like GoSecure's `dtd-finder` to overwrite existing entities. The exploit leverages the `jar` protocol on Java applications to read files from archives and inject them into error messages, revealing sensitive data like `/etc/passwd`. |
| 2025-08-14 2025 | XML External Entity Prevention · OWASP Cheat Sheet Series beginner 19 min read | Library that guides developers in preventing XML External Entity (XXE) injection vulnerabilities, a common OWASP Top 10 threat. It details specific configurations for various XML parsers across languages like Java (JAXP, DOM4J), C++ (libxml2, libxerces-c), and ColdFusion (Adobe, Lucee), emphasizing the critical need to disable DOCTYPE declarations and external entity loading to mitigate risks like SSRF and denial-of-service attacks. → cheatsheetseries.owasp.org |
| 2025-08-14 2025 | What is XXE (XML external entity) injection? Tutorial & Examples | Web Security Academy beginner 7 min read | Library detailing XML external entity (XXE) injection, a web security vulnerability allowing attackers to interfere with XML data processing. It covers exploiting XXE to retrieve files, perform server-side request forgery (SSRF), and exfiltrate data via blind XXE techniques. The library also discusses XInclude attacks and XXE vulnerabilities in file uploads, specifically mentioning SVG format. → portswigger.net |
| 2025-08-14 2025 | From blind XXE to root-level file read access – Honoki advanced 10 min read | Writeup detailing blind XXE exploitation, focusing on error message analysis to identify the Java SAX Parser and infer firewall behavior. The technique successfully enumerated internal services and reached internal applications like wiki.company.internal, demonstrating how to elevate a medium-criticality XXE vulnerability to a critical finding. |
| 2025-08-14 2025 | XXE - XML External Entity Attack beginner | XXE, or XML External Entity Attack, is a type of security vulnerability where an attacker can exploit the processing of XML data by including external entities that can disclose confidential information, execute remote code, or cause a denial of service. This attack can occur when an application processes XML input without proper validation and allows external entities to be included. Preventing XXE attacks involves disabling external entity processing, using whitelists for allowed entities, and validating input data to ensure it does not contain malicious XML entities. → slideshare.net |
| 2025-08-14 2025 | XXE at Bol.com – Jonathan Bouman – Medium intermediate | The content appears to be a post titled "XXE at Bol.com" by Jonathan Bouman on the platform Medium. It likely discusses a potential XML External Entity (XXE) vulnerability found at Bol.com, a Dutch online retailer. XXE vulnerabilities can allow attackers to exploit XML processing functionality and access sensitive data. The post may delve into the impact of this vulnerability on Bol.com's security and how it was discovered or addressed. For more detailed information, it is recommended to read the full post on Medium. |
| 2024-11-10 2024 | GitHub - whitel1st/docem: A tool to embed XXE and XSS payloads in docx, odt, pptx, xlsx files (oxml_xxe on steroids) intermediate 3 min read XSS | Tool for embedding XXE and XSS payloads into document formats like DOCX, ODT, and PPTX. This utility operates by identifying "magic symbols" within sample documents and replacing them with specified payloads. It offers flexible payload injection modes, allowing for placement per document, per file, or per specific location, and supports custom payload files for both XXE and XSS vulnerabilities. Docem aims to improve upon the usability of tools like oxml_xxe for large-scale payload generation. |
| 2024-09-21 2024 | XXE : From Zero to Hero beginner | Hello fellow hackers, I hope you all are doing good and learning something new :) . As i said in my RECON blog I will be writing about… → infosecwriteups.com |
| 2023-08-19 2023 | XXExploiter intermediate 3 min read | Tool for generating XML payloads and serving DTDs for XML External Entity (XXE) injection attacks. XXExploiter supports various modes including XML, Out-of-Band (OOB), and CDATA extraction, with options for command execution via PHP's expect, data exfiltration, and fuzzing specific parameters using wordlists. It can automatically start a server for OOB data transfer and also acts as a client to send XML files and retrieve responses. |
| 2022-08-10 2022 | How to Protect Text Input from XML External Entity (XXE) Attacks using Pyth intermediate Python | The content discusses protecting text input from XML External Entity (XXE) attacks using Python. XXE attacks aim to disrupt an application's handling of serialized data. Implementing countermeasures in Python can help prevent these attacks and ensure the security of the application. |
| 2021-05-18 2021 | If you find powerful OXML XXE tool? it’s “DOCEM” intermediate Bug Bounty | The content shares a tool called "DOCEM" for XXE testing, which is considered more convenient than other existing tools. It aims to assist in finding a powerful OXML XXE tool, offering a more user-friendly experience compared to manual methods or previously available tools. |
| 2021-05-04 2021 | XXE : From Zero to Hero beginner | This content, "XXE: From Zero to Hero," likely explores the topic of XML External Entity (XXE) vulnerabilities. It probably guides readers from a foundational understanding of XXE to mastering its exploitation and defense. The content could cover how XXE flaws arise from improper XML parsing, their potential impacts (like data exfiltration or denial-of-service), and techniques for identifying and mitigating these vulnerabilities. |
| 2021-01-20 2021 | XXE attacks 😈 beginner | Various file formats such as PDF, Excel, SVG, and ebooks utilize XML and can be susceptible to XXE (XML External Entity) attacks. These attacks involve exploiting vulnerabilities in XML parsers to access sensitive data or execute malicious actions. It is crucial for developers and users to be aware of the risks associated with XXE attacks and implement proper security measures to prevent unauthorized access to data. |
| 2018-09-13 2018 | XXE - Things Are Getting Out of Band intermediate 7 min read | Technique detailing out-of-band XXE attacks, leveraging FTP and HTTP handlers for blind exfiltration of sensitive data like `/etc/passwd`. The technique applies to vulnerable Java versions (<1.7 and sometimes >1.7) and can extend to ASP.NET applications for potential RCE via web shell downloads. → blog.zsec.uk |
| 2017-02-07 2017 | Advice From A Researcher: Hunting XXE For Fun and Profit intermediate | The content is titled "Advice From A Researcher: Hunting XXE For Fun and Profit." It likely discusses insights and tips from a researcher on exploiting XML External Entity (XXE) vulnerabilities for both enjoyment and financial gain. The focus is on the process of identifying and exploiting XXE vulnerabilities in systems for various purposes. This content may provide guidance on how to effectively hunt for XXE vulnerabilities and potentially profit from them. |
| 2017-01-31 2017 | BuffaloWill/oxml_xxe: A tool for embedding XXE/XML exploits into different intermediate | Tool for embedding XXE/XML exploits into various OXML document file formats including DOCX, XLSX, PPTX, ODT, ODG, ODP, ODS, and SVG. Developed in Ruby using Sinatra, Bootstrap, and Slim, this application facilitates testing XXE vulnerabilities in file upload functionalities, referencing techniques discussed in the BH USA 2015 presentation. |