XML External Entity

Cross-platform resources for XML External Entity: curated HTB machines, PortSwigger labs and TryHackMe rooms with validated writeups and related skills.

XML External Entity

This page aggregates cross-platform resources to practice XML External Entity: retired Hack The Box machines, PortSwigger Web Security Academy labs and TryHackMe rooms, plus curated resources (HackTricks, PortSwigger, etc.) and related skills.

Curated resources

Source	Link
HackTricks	https://book.hacktricks.wiki/en/pentesting-web/xxe-xee-xml-external-entity.html

HTB machines practicing XML External Entity (6)

Machine	OS	Difficulty
Aragog	Linux	MEDIUM
BountyHunter	Linux	EASY
DevOops	Linux	MEDIUM
Fulcrum	Linux	INSANE
NodeBlog	Linux	EASY
RE	Windows	HARD

PortSwigger labs practicing XML External Entity (9)

Lab	Difficulty	Topic	Official
Exploiting XXE to perform SSRF attacks	APPRENTICE	XXE (XML External Entity)	Open
Exploiting XXE to retrieve data by repurposing a local DTD	APPRENTICE	XXE (XML External Entity)	Open
Exploiting XXE using external entities to retrieve files	APPRENTICE	XXE (XML External Entity)	Open
Blind XXE with out-of-band interaction	PRACTITIONER	XXE (XML External Entity)	Open
Blind XXE with out-of-band interaction via XML parameter entities	PRACTITIONER	XXE (XML External Entity)	Open
Exploiting blind XXE to exfiltrate data using a malicious external DTD	PRACTITIONER	XXE (XML External Entity)	Open
Exploiting blind XXE to retrieve data via error messages	PRACTITIONER	XXE (XML External Entity)	Open
Exploiting XInclude to retrieve files	PRACTITIONER	XXE (XML External Entity)	Open
Exploiting XXE via image file upload	PRACTITIONER	XXE (XML External Entity)	Open

TryHackMe rooms practicing XML External Entity (4)

Room	Difficulty	Type	Access	Official
Advent of Cyber 2024	EASY	Walkthrough	🟢 Free	Open
GeoServer: CVE-2025-58360	MEDIUM	Walkthrough	🟢 Free	Open
NahamStore	MEDIUM	Challenge	🟢 Free	Open
XXE Injection	MEDIUM	Walkthrough	🔵 VIP	Open

Related skills

• /en/skills/lfi
• /en/skills/ssrf

---

← Back to the full glossary

Last updated: 2026-05-09