XML External Entity (XXE) Injection Testing Skill

Purpose

Validate XXE vulnerabilities by injecting malicious XML documents containing external entity references and observing:

• File disclosure via file:// protocol
• Server-Side Request Forgery (SSRF) via http:// or other protocols
• Denial of Service via entity expansion (billion laughs) or large file reads
• Blind XXE via out-of-band DNS/HTTP callbacks
• Error-based extraction via parser error messages containing file contents

Vulnerability Types Covered

1. Classic XXE / File Disclosure (CWE-611)

Read local files by defining external entities pointing to file:// URIs.

Detection Methods:

• Inject <!ENTITY xxe SYSTEM "file:///etc/passwd"> and reference &xxe;
• Look for file contents in response body or error messages