🧪 Labs › Injection

XML External Entities (XXE)

Severity: High

A permissive XML parser can be told to fetch files and URLs for you.

What it is

XML lets a document define 'entities' — named shortcuts. An EXTERNAL entity tells the parser to pull its value from a URI, including local files. If an app parses attacker-controlled XML with external entities enabled, the parser will happily read files or make network requests on the attacker's behalf.

Anywhere an app accepts XML — SOAP, SAML, document uploads, some APIs, even SVGs — is a candidate.

It ranges from reading sensitive files to acting as a springboard for server-side request forgery.

How to approach it

Find an endpoint that accepts XML and reflects or acts on any part of it.
Define an entity whose value comes from a local resource and reference it where the response will echo it back.
When the response doesn't echo, look for an out-of-band channel to pull the data to a server you control.
Note what the parser can reach — local files, internal URLs — and reason about impact from there.

Your task

Use the document parser to read a file outside the web root.

▶ Access the lab

Opens your hosted RatCTF instance. Work on it directly — there's nothing to submit here; you'll know when you've solved it.

How to prevent it

Disable external entity and DTD processing in the XML parser — this is a one-line config in most libraries.
Prefer less dangerous formats (JSON) where XML isn't required.
Patch and harden the parser; don't rely on input filtering.

More Injection labs

SQL Injection — Make the database answer a question the application never meant to ask.
Server-Side Template Injection (SSTI) — When user input becomes part of a server template, the template engine runs it.
OS Command Injection — A feature that shells out to a system command, with your input in the command line.
Insecure Deserialization — Turning attacker-controlled bytes back into live objects can run attacker code.

← All labs