# XML External Entity (XXE) Injection

> Master XXE injection attacks, from basic local file reading to blind out-of-band exfiltration and SSRF chaining.

Canonical: https://codelivly.com/rooms/xml-external-entity-xxe-injection
Last updated: 2026-08-17

| | |
|---|---|
| Level | Intermediate |
| Category | Cybersecurity |
| Lessons | 5 |
| Estimated time | 3 h |
| XP | 500 |

This room dives deep into XML External Entity (XXE) injection, a critical web vulnerability that occurs when applications parse untrusted XML input. You will learn how XML parsers process Document Type Definitions (DTDs) and entities, and how attackers abuse these features to read local files, perform Server-Side Request Forgery (SSRF), and exfiltrate data out-of-band. Through hands-on labs, you will exploit vulnerable REST APIs, SOAP services, and file upload features (like SVG and DOCX), ultimately learning how to secure XML parsers against these devastating attacks.

## Lessons

1. What is XXE & How XML Parsers Get Exploited (30 min)
2. Basic XXE - Reading Local Files (30 min)
3. Blind XXE & Out-of-Band Data Exfiltration (30 min)
4. XXE to SSRF Chaining (30 min)
5. Guided Lab: Extracting Sensitive Files via XXE (30 min)

## Related

- [Learning path: Web Application Security](https://codelivly.com/learning-paths/web-application-security)
- [All rooms](https://codelivly.com/rooms)