XXE Playground
An XML upload feature that expands external entities. Smuggle a local file read through a "harmless" XML document.
XML has a feature almost nobody wants: documents can define entities that pull in external content, including local files. Feed such a document to a parser with entity expansion enabled and a harmless-looking upload becomes a file read.
How to use it
- Submit an ordinary XML document.
- Define an external entity pointing at a local file.
- Reference the entity and read the file back in the response.
What to take away
It is a parser setting, not a code bug
The application often contains no mistake at all — the default configuration of the XML parser does the damage. Disable DTDs and external entities.
XXE frequently becomes SSRF
An entity can point at a URL as easily as a file, which turns the parser into a request-forging proxy.
It hides in unexpected formats
DOCX, XLSX, SVG and SAML assertions are all XML underneath, which is how XXE reaches applications that believe they never parse XML.
Frequently asked questions
How do I stop XXE?
Disable DTD processing and external entity resolution in the parser. Every major XML library documents the exact flags; it is usually one line.
What is a billion laughs attack?
A denial-of-service using nested entities that expand exponentially, exhausting memory from a very small file. Disabling DTDs stops it too.
Where this fits in the course
This security lab pairs with Path 11 — Web Security — see all 26 learning paths.
It runs entirely in your browser: nothing is uploaded, no account is needed, and it is free.
Related
- SSRF Playground — A "fetch this URL for me" feature with no allowlist. Point it at internal-looking addresses and see what it leaks.
- Path Traversal Playground — A fake "view file" feature that trusts the filename you give it. Climb out of the intended folder with ../ and read files you shouldn't.
- Insecure Deserialization Toy — A "remember me" cookie is a trusted, deserialized object. Add one field to grant yourself admin with zero login.
- Secure Code Review Toy — Paste a code snippet and get flagged patterns — eval, string-built SQL, hardcoded secrets. Not a real SAST tool, but trains the eye.