If you have never heard of XML or document parsing before, you are in exactly the right place — this step gives you everything you need before the hands-on exercise begins.
What is XML?
XML (eXtensible Markup Language) is a language for describing structured data. You have probably seen it without knowing it — it is the format behind RSS feeds, Microsoft Office documents, SOAP web services, Android app manifests, and many configuration files.
XML looks a lot like HTML, but it is used to carry data, not to display web pages. A simple XML document might look like this:
<?xml version="1.0" encoding="UTF-8"?>
<employees>
<employee>
<id>42</id>
<name>Alice</name>
<role>Engineer</role>
</employee>
</employees>Every piece of data is wrapped in matching tags. Tags can be nested to represent relationships. An XML parser is the software that reads this text and turns it into data a program can use.
What is an XML entity?
XML supports a feature called entities — a way to define shorthand references for repeated text. You have already used them without realising it: in HTML, & is an entity that stands for the & character.
Inside an XML document you can declare your own entities in a special block called a DOCTYPE declaration:
<!DOCTYPE greeting [
<!ENTITY hello "Hello, World!">
]>
<message>&hello;</message>When the parser processes this document, it replaces every &hello; reference with the string "Hello, World!". This is called entity resolution.
What is an external entity?
The entity definition in the example above is called an internal entity — the replacement value is written directly in the document.
XML also supports external entities, where the replacement value is fetched from a URI:
<!ENTITY xxe SYSTEM "file:///etc/passwd">The SYSTEM keyword tells the parser: "Load the replacement value from this external resource." The file:// scheme points to a file on the server's filesystem.
When a parser resolves this entity, it reads the file at the given path and substitutes its contents wherever the entity reference (&xxe;) appears in the document. For a parser running on a Linux server, file:///etc/passwd returns the system's user account list.
What is XXE injection?
XXE (XML External Entity) injection is what happens when an attacker can submit an XML document to a web application and the application's parser resolves external entities without restriction.
By supplying a specially crafted DOCTYPE block, an attacker can instruct the parser to:
- Read any file the server process can access: configuration files, SSH keys, source code, database credentials
- Make server-side HTTP requests (turning XXE into SSRF — Server-Side Request Forgery)
- In some configurations, execute commands or access internal network resources
The attack works because the XML parser does the file reading on the server — completely invisible to the browser.
Why this matters
XXE vulnerabilities have been found in major platforms: Apache Struts, LibreOffice, Microsoft Excel, the Python lxml library, and XML-processing components used in thousands of enterprise applications.
Despite being well-documented, XXE is still classified as A05:2021 — Security Misconfiguration in the OWASP Top 10 because misconfiguring an XML parser to allow external entities is extremely easy and extremely common.
What you will do in this lesson
You will attack a purpose-built practice application called DataSync — a fictional enterprise XML import portal deliberately built with a security flaw.
Your goal: craft an XML document with an external entity declaration that points to a file on the server. When the parser resolves the entity, the file contents appear in the output along with a challenge flag. You then copy the flag and submit it to complete the lesson.
Everything happens in your browser. No tools to install, no terminal to open.