XML External Entity

Cross-platform resources for XML External Entity: curated HTB machines, PortSwigger labs and TryHackMe rooms with validated writeups and related skills.

This page aggregates cross-platform resources to practice XML External Entity: retired Hack The Box machines, PortSwigger Web Security Academy labs and TryHackMe rooms, plus curated resources (HackTricks, PortSwigger, etc.) and related skills.

Coverage: 19 challenges across 3 platforms — 6 HackTheBox · 9 PortSwigger · 4 TryHackMe. 6 with a Spanish writeup, 6 with a video writeup.

Where to start

Ordered by actual difficulty. At the same level: isolated lab first, then the guided room, and the full machine last.

1. PortSwigger — Exploiting XXE to perform SSRF attacks (Apprentice) · 🇬🇧
2. PortSwigger — Exploiting XXE to retrieve data by repurposing a local DTD (Apprentice) · 🇬🇧
3. PortSwigger — Exploiting XXE using external entities to retrieve files (Apprentice) · 🇬🇧
4. TryHackMe — Advent of Cyber 2024 (Easy · ~1440 min) · 🇬🇧
5. HackTheBox — BountyHunter (Fácil) · 🇪🇸 🇬🇧 📹
6. HackTheBox — NodeBlog (Fácil) · 🇪🇸 🇬🇧 📹

Curated resources

Source	Link
HackTricks	https://book.hacktricks.wiki/en/pentesting-web/xxe-xee-xml-external-entity.html

HTB machines practicing XML External Entity (6)

Machine	OS	Difficulty	Writeup
Aragog	Linux	MEDIUM	🇪🇸 🇬🇧 📹
BountyHunter	Linux	EASY	🇪🇸 🇬🇧 📹
DevOops	Linux	MEDIUM	🇪🇸 🇬🇧 📹
Fulcrum	Linux	INSANE	🇪🇸 🇬🇧 📹
NodeBlog	Linux	EASY	🇪🇸 🇬🇧 📹
RE	Windows	HARD	🇪🇸 🇬🇧 📹

PortSwigger labs practicing XML External Entity (9)

Lab	Difficulty	Topic	Official
Exploiting XXE to perform SSRF attacks	APPRENTICE	XXE (XML External Entity)	Open
Exploiting XXE to retrieve data by repurposing a local DTD	APPRENTICE	XXE (XML External Entity)	Open
Exploiting XXE using external entities to retrieve files	APPRENTICE	XXE (XML External Entity)	Open
Blind XXE with out-of-band interaction	PRACTITIONER	XXE (XML External Entity)	Open
Blind XXE with out-of-band interaction via XML parameter entities	PRACTITIONER	XXE (XML External Entity)	Open
Exploiting blind XXE to exfiltrate data using a malicious external DTD	PRACTITIONER	XXE (XML External Entity)	Open
Exploiting blind XXE to retrieve data via error messages	PRACTITIONER	XXE (XML External Entity)	Open
Exploiting XInclude to retrieve files	PRACTITIONER	XXE (XML External Entity)	Open
Exploiting XXE via image file upload	PRACTITIONER	XXE (XML External Entity)	Open

TryHackMe rooms practicing XML External Entity (4)

Room	Difficulty	Type	Access	Official
Advent of Cyber 2024	EASY	Walkthrough	🟢 Free	Open
GeoServer: CVE-2025-58360	MEDIUM	Walkthrough	🟢 Free	Open
NahamStore	MEDIUM	Challenge	🟢 Free	Open
XXE Injection	MEDIUM	Walkthrough	🔵 VIP	Open

Related skills

• /en/skills/lfi
• /en/skills/ssrf

---

← Back to the full glossary

Last updated: 2026-08-13