Exploiting XXE to Perform SSRF

Fri, 09 Oct 2026 18:09:00 +0300


Platform	PortSwigger Web Security Academy
Topic	XML external entity (XXE) injection
Lab	Exploiting XXE to perform SSRF attacks
Difficulty	Apprentice
Goal	Read the server’s IAM credentials from cloud metadata
Tools	Burp Suite (Proxy + Repeater)

The idea

In the file-retrieval lab the external entity pointed at a local file with file://. Point it at an http:// URL instead and the XML parser becomes an HTTP client that fetches whatever URL we give it. That is SSRF (server-side request forgery): making the server send requests to targets we choose, from its own trusted position on the network.

Exploiting XXE to Retrieve Files

Fri, 09 Oct 2026 17:43:00 +0300


Platform	PortSwigger Web Security Academy
Topic	XML external entity (XXE) injection
Lab	Exploiting XXE using external entities to retrieve files
Difficulty	Apprentice
Goal	Read `/etc/passwd` from the server
Tools	Burp Suite (Proxy + Repeater)

What is XXE?

XML external entity (XXE) injection happens when an application parses XML we control, and the parser (the library that reads the XML and turns it into data the app can use) is allowed to process external entities. An entity in XML is a named placeholder, declared in a DTD (Document Type Definition) and referenced in the document; an external entity takes its value from a URI the parser fetches. If we can declare our own entity that points at a local file, the parser reads that file and we can often get the contents reflected back.

Xxe on Yusuf AlMahmeed

Exploiting XXE to Perform SSRF

The idea

Exploiting XXE to Retrieve Files

What is XXE?