# XML External Entities

> Discover and exploit XXE to read local files, pivot to SSRF, and exfiltrate data out-of-band through vulnerable XML parsers.

- **URL:** https://hackindex.io/learn/oswa-web-200-study-path/xml-external-entities
- **Certification:** [OSWA (WEB-200) Study Path](https://hackindex.io/learn/oswa-web-200-study-path.md)
- **Estimated study hours:** 1.5
- **Published:** 2026-09-26
- **Updated:** 2026-09-26

XML External Entity (XXE) injection abuses XML parsers that resolve external entities. When an application accepts XML input and its parser is configured to process DTDs and external entities, an attacker can read local files, trigger server-side requests (SSRF), and exfiltrate data out-of-band. XXE hides in obvious XML endpoints and in less obvious places like SOAP services, SVG uploads, and document formats (DOCX, XLSX) that are XML under the hood.

## XXE Discovery

Finding XXE starts with identifying endpoints that accept XML, then testing whether the parser expands entities. Internal entity expansion confirms the parser processes DTDs; an external file-read entity confirms exploitability. When no output is returned, a blind test using an out-of-band callback proves the vulnerability. SVG and file-upload paths are common XXE vectors worth testing explicitly.

## XXE Exploitation

Exploitation reads server files in-band, pivots to SSRF by pointing an entity at internal services or cloud metadata, and handles blind cases with out-of-band exfiltration through an external DTD. CDATA wrapping enables reading files that would otherwise break XML parsing, and error-based XXE leaks file contents inside parser error messages when other channels are closed.

## Study material

- [XXE DTD Processing Checks](https://hackindex.io/services/web/vulnerability-discovery/xxe-dtd-processing-checks.md) (read, core)
- [XXE Exploitation](https://hackindex.io/services/web/exploitation/xxe-exploitation.md) (read, core)