Injection

XML External Entity (XXE)

Learn how attackers abuse XML parsers to read server files, perform SSRF, and exfiltrate data — a vulnerability hiding in every API that accepts XML.

Intermediate40 min9 lessons3 hands-on

Start free →I have an account

First lesson free. The full module is part of Pro.

You'll be able to

✓Understand how XXE arises from XML external entity processing
✓Read local files via XXE using file:// URIs
✓Perform blind XXE with out-of-band data exfiltration
✓Escalate XXE to SSRF to reach internal services

Lessons

1How Researchers Read Amazon's Internal Systems with One XML Tag
2XML Entities — The Feature That Became a Vulnerability
3Payloads — File Read, SSRF, and Blind Exfil
4Mini Lab — Identify the XXE Payload
5Your Turn: Declare a Malicious EntityHANDS-ON
6Level Up: Blind / Out-of-BandHANDS-ON
7Module quiz
8Preventing XXE — Safe Parser Configuration
9Hands-on Lab: Exploit CardVaultHANDS-ON