📖 What is XML External Entity (XXE)?
XML External Entity (XXE) is a vulnerability that allows an attacker to interfere with an application's processing of XML input. It can lead to the disclosure of internal files, server-side request forgery, and in some cases, remote code execution by referencing external entities.
"Focus on applications that accept XML or SOAP. If the server processes external entities, you can often read sensitive files like /etc/passwd on Linux systems."
📚 Certification: CompTIA PenTest+ (PT0-002)
🔑 What are the Key Concepts of XML External Entity (XXE)?
- ▸ Document Type Definitions (DTDs) allow the definition of custom entities, which attackers exploit to inject external references into the XML parsing process.
- ▸ External entities enable the parser to fetch content from external URIs or local files, often leading to sensitive data disclosure like /etc/passwd.
- ▸ Out-of-Band (OOB) XXE is used when the application does not return the parsed output, requiring an external server to capture the exfiltrated data.
- ▸ XXE can be leveraged for Server-Side Request Forgery (SSRF), allowing attackers to probe internal network services or access cloud instance metadata services.
- ▸ The primary mitigation is disabling DTD processing or external entity resolution within the XML parser configuration to prevent the execution of external references.
🎯 How does XML External Entity (XXE) appear on the PT0-002 Exam?
You may be asked to identify the correct payload to read a local system file, such as /etc/passwd, when testing a web application that accepts SOAP requests or XML-based configuration files.
A scenario might describe a 'blind' XML vulnerability where no data is returned in the HTTP response; you must choose a technique involving an external DTD and an OOB server.
Expect questions about using XXE to perform internal network reconnaissance, where the attacker uses the XML parser to send requests to internal IP addresses and ports to identify running services.
❓ Frequently Asked Questions
How does XXE differ from a standard Local File Inclusion (LFI) attack?
While both can read local files, LFI typically exploits unsanitized file paths in URL parameters, whereas XXE exploits the way an XML parser handles external entity definitions within the document structure.
What is the 'Billion Laughs' attack and is it a type of XXE?
The Billion Laughs attack is an XML entity expansion attack designed for Denial of Service (DoS) rather than data theft. It uses nested entities to consume all available server memory.