xxe-xml-external-entity

An XML External Entity (XXE) testing playbook for use when XML, SVG, OOXML, SOAP, or parser-driven imports may resolve external entities, files, or internal network resources. It begins with the classic file-read payload, a DOCTYPE declaring a SYSTEM entity that points at a local file, and a checklist for confirming whether entity content reflects in the response.

Attack-surface discovery covers direct XML inputs such as SOAP endpoints, XML REST APIs, and RSS or Atom parsers, plus non-obvious cases like switching a JSON request's Content-Type to application/xml, and file uploads including SVG and Office Open XML documents (docx, xlsx, pptx), which are ZIP archives of XML. When entities are parsed but not echoed, the guide walks through out-of-band exfiltration using an attacker-hosted malicious DTD, error-based leaks, and DNS-only callbacks, which it emphasizes as critical for blind cases.

Further sections enumerate Linux and Windows file-read targets, SVG upload XXE, XInclude for when DOCTYPE is blocked, protocol handlers including file, http, the php filter wrapper for base64, ftp, and gopher, the XXE-to-SSRF chain including cloud metadata endpoints, defense bypasses, and local DTD injection for blind amplification. A companion SCENARIOS.md is referenced for real-world CVE chains such as Apache Solr XXE plus RCE and a step-by-step docx XXE. It is framed factually as a neutral security-testing reference.