XML External Entity (XXE) injection is a vulnerability that occurs when XML input containing a reference to an external entity is processed by a weakly configured XML parser.

What XXE Can Do:

• File Disclosure: Read local files from the server
• SSRF Attacks: Make requests to internal systems
• DoS Attacks: Consume server resources
• RCE: Remote code execution in some cases

Try These XXE Payloads:

Create XML files with these contents and upload them:

1. Basic File Disclosure (Windows):

2. Basic File Disclosure (Linux):

3. SSRF via XXE:

4. Billion Laughs DoS Attack:

XXE Prevention Methods:

• Disable External Entities: Configure XML parser to disable external entity processing
• Input Validation: Validate and sanitize XML input
• Use Safe Parsers: Use XML parsers that are secure by default
• Whitelisting: Only allow specific XML structures
• Patch Libraries: Keep XML processing libraries updated

Test Steps:

1. Copy one of the payloads above into a text file
2. Save it with a .xml extension
3. Upload the file using the form below
4. Observe the server response for sensitive information