XML external entity (XXE) injection - PortSwigger
https://portswigger.net/web-security/xxe
In this section, we'll explain what XML external entity injection is, describe some common examples, explain how to find and exploit various kinds of XXE injection, and summarize how to prevent XXE …
XML External Entity (XXE) Attack Guide | Hackviser
https://hackviser.com/tactics/pentesting/web/xxe
XML External Entity (XXE) is a web security vulnerability that allows an attacker to interfere with an application's processing of XML data. It can lead to disclosure of confidential data, denial of service, …
XXE Complete Guide: Impact, Examples, and Prevention
https://www.hackerone.com/knowledge-center/xxe-complete-guide-impact-examples-and-prevention
XML External Entity (XXE) is an application-layer cybersecurity attack that exploits an XXE vulnerability to parse XML input. XXE attacks are possible when a poorly configured parser processes XML input …
XXE - XEE - XML External Entity - HackTricks
https://hacktricks.wiki/en/pentesting-web/xxe-xee-xml-external-entity.html
This payload defines an XML parameter entity %xxe and incorporates it within the DTD. When processed by an XML parser, this payload fetches the external DTD from the attacker’s server.
XML external entity attack - Wikipedia
https://en.wikipedia.org/wiki/XML_external_entity_attack
XML External Entity attack, or simply XXE attack, is a type of attack against an application that parses XML input. This attack occurs when XML input containing a reference to an external entity is …
XML External Entity Prevention - OWASP Cheat Sheet Series
https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html
Detailed XXE Prevention guidance is provided below for multiple languages (C++, Cold Fusion, Java, .NET, iOS, PHP, Python, Semgrep Rules) and their commonly used XML parsers.
XML External Entity (XXE) Processing - OWASP Foundation
https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing
Detailed guidance on how to disable XXE processing, or otherwise defend against XXE attacks is presented in the XML External Entity (XXE) Prevention Cheat Sheet.
XML External Entity - GeeksforGeeks
https://www.geeksforgeeks.org/ethical-hacking/xml-external-entity-xxe-processing/
Nov 25, 2025 · XML External Entity (XXE) vulnerabilities occur when an application parses untrusted XML input that contains external entity references, and the XML parser resolves those entities without …
XML External Entity (XXE) and Billion Laughs attack
https://www.geeksforgeeks.org/ethical-hacking/xml-external-entity-xxe-and-billion-laughs-attack/
Jul 24, 2025 · XXE or XML External Entity attack is a web application vulnerability that affects a website which parses unsafe XML that is driven by the user. XXE attack when performed successfully can …
PayloadsAllTheThings/XXE Injection/README.md at master - GitHub
https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/XXE%20Injection/README.md
Most XXE payloads detailed above require control over both the DTD or DOCTYPE block as well as the xml file. In rare situations, you may only control the DTD file and won't be able to modify the xml file.
Learn what system design is and why it is important for building scalable, reliable software. Discover key principles and how to design systems that last.
Learn how to choose a database for your system with this evidence-based framework. Compare SQL, NoSQL, graph, and time-series databases to make the right decision.
MIT Technology Review Analysis: OpenAI's Share Drops to 46%, Protests and Regulatory Lawsuits. Learn how AI enters the survival of the fittest phase and what awaits the market in 90 days. Read the full analysis.
Learn how to create a strong password that is hard to crack using passphrases. Discover expert tips, avoid common mistakes, and secure your accounts today.
Learn how to protect yourself from phishing attacks with 7 proven strategies. Spot scams, use MFA, and secure your data. Start defending against cyber threats today.
Learn what is the difference between encryption and hashing, their use cases, and when to use each. A clear guide with examples and a comparison table.
Learn how to design a scalable system architecture with a step-by-step framework. Master scaling principles, microservices, and database strategies for resilient systems.
Analysis of Global AI Trends 2026: Governance, Computing, Agentic AI, and Energy. Find out where the market is turning into the 'trough of disillusionment' and where it is accelerating. Read insights and forecasts.
Analysis of trends, hidden risks, and geopolitical implications of Top 10 Emerging Technologies 2026. Who benefits from new developments and who loses. Read the analytics.
Analysis of EIC Tech Report 2026: 25 early deep-tech signals to strengthen Europe. Bio-inspired AI, quantum communications, biomineralization, and surgical robotics. Who wins and who loses? Read the full review.