NEW350+ rooms now have a live terminal, so you can learn by typing the commands, right in your browser.Learn in a live terminal. 350+ rooms.Try a lab♥ Codelivly is 100% free, no paywall. If it helped you, chip in to keep it running.100% free. Help keep it so.Support us
[>_] ROOM · Cybersecurity
XML External Entity (XXE) Injection
Master XXE injection attacks, from basic local file reading to blind out-of-band exfiltration and SSRF chaining.
Room tasks
1What is XXE & How XML Parsers Get Exploited
2Basic XXE - Reading Local Files
3Blind XXE & Out-of-Band Data Exfiltration
4XXE to SSRF Chaining
5Guided Lab: Extracting Sensitive Files via XXE
Frequently Asked Questions
What is XXE injection?
XML External Entity injection abuses an XML parser that processes external entity declarations. Attackers can read local files, make server-side requests, or sometimes cause denial of service.
What is blind XXE?
In blind XXE the application does not return entity values in its response. Attackers instead use out-of-band channels, such as DNS or HTTP callbacks to a server they control, to extract data.
How do you prevent XXE?
Disable DTDs and external entity resolution in the XML parser, use less complex formats like JSON where possible, and keep parser libraries updated. This free Codelivly room lets you practice the attacks safely.