domains / families / security / xxe-xml-external-entity

xxe-xml-external-entity

separate

XXE playbook. Use when XML, SVG, OOXML, SOAP, or parser-driven imports may resolve external entities, files, or internal network resources.

When to use

• XML, SVG, OOXML, SOAP, or parser-driven imports
• OOB exfiltration
• blind XXE detection
• XXE-to-SSRF chain
• Office docx XXE
• PHP expect:// RCE
• Solr XXE+RCE
• XInclude attack

Skill page

Source