Lion Cipher Lab
Exploit and fix XXE (XML External Entity injection) in your own lab
- AppSec / DevSecOps
- Intermediate
- ~60 min
- Free · no account required
Why it matters
XXE — XML External Entity injection — is what happens when an application parses XML you control with a parser left on its factory settings. Those settings, for historical reasons, tell the parser to resolve 'external entities': placeholders in the document that the parser fills in by reading a file off the server's disk or fetching a URL from inside the server's network. The developer thinks they accepted a harmless bit of markup; the attacker thinks they got a free read of /etc/passwd, an internal admin page, or the cloud metadata service. And XML is everywhere it is not obvious: SOAP APIs,…
What you'll learn
- explaining what XXE is: an XML parser resolving an attacker-declared external entity, so a value in the document gets silently replaced with the contents of a local file (or a URL the server can reach)
- defining the XML vocabulary that makes the attack possible — entity, DOCTYPE, and DTD — and understanding why the 'external' kind of entity is the dangerous part
- building a tiny vulnerable XML-parsing web app on your own machine with Python, Flask, and lxml's default parser
- crafting an XXE payload — a DOCTYPE that declares <!ENTITY xxe SYSTEM "file://..."> — and using it to read a secret file's contents back through the app
- recognizing the 'billion laughs' entity-expansion denial-of-service by its shape alone, and understanding why you never have to run it to respect the risk
- fixing the bug with defusedxml (which refuses any document that declares a DOCTYPE) and, as an alternative, hardening lxml with resolve_entities=False, no_network=True, load_dtd=False
- re-running the exact same payload against the fixed app and confirming it is refused (DTDForbidden) instead of leaking the file
- knowing where XXE bites in the real world — SOAP, SAML, SVG uploads, DOCX/XLSX (which are zip + XML), config imports — and how it pivots into SSRF and out-of-band exfiltration
Steps in this lab
- What XXE is — the vocabulary and the ground rules
- Set up: confirm Python, make a folder, install the libraries, plant a secret
- Build the VULNERABLE XML-parsing app (the bug, on purpose)
- Prove the XXE works (leak your secret file)
- See (do NOT run) the 'billion laughs' entity-expansion bomb
- Fix it with defusedxml, then re-run the exact payload
- What you did — and the reflex to keep