XML External Entity

Recursos cross-platform para XML External Entity: máquinas HTB, labs PortSwigger y rooms TryHackMe curados, con writeups validados y skills relacionadas.

​

XML External Entity

Esta página agrega los recursos para practicar XML External Entity de forma cross-platform: máquinas retiradas de Hack The Box, labs de PortSwigger Web Security Academy y rooms de TryHackMe, más recursos curados (HackTricks, PortSwigger, etc.) y skills relacionadas.

​

Recursos curados

Fuente	Enlace
HackTricks	https://book.hacktricks.wiki/en/pentesting-web/xxe-xee-xml-external-entity.html

​

Máquinas HTB que practican XML External Entity (6)

Máquina	SO	Dificultad
Aragog	Linux	MEDIUM
BountyHunter	Linux	EASY
DevOops	Linux	MEDIUM
Fulcrum	Linux	INSANE
NodeBlog	Linux	EASY
RE	Windows	HARD

​

Labs PortSwigger que practican XML External Entity (9)

Lab	Dificultad	Topic	Oficial
Exploiting XXE to perform SSRF attacks	APPRENTICE	XXE (XML External Entity)	Abrir
Exploiting XXE to retrieve data by repurposing a local DTD	APPRENTICE	XXE (XML External Entity)	Abrir
Exploiting XXE using external entities to retrieve files	APPRENTICE	XXE (XML External Entity)	Abrir
Blind XXE with out-of-band interaction	PRACTITIONER	XXE (XML External Entity)	Abrir
Blind XXE with out-of-band interaction via XML parameter entities	PRACTITIONER	XXE (XML External Entity)	Abrir
Exploiting blind XXE to exfiltrate data using a malicious external DTD	PRACTITIONER	XXE (XML External Entity)	Abrir
Exploiting blind XXE to retrieve data via error messages	PRACTITIONER	XXE (XML External Entity)	Abrir
Exploiting XInclude to retrieve files	PRACTITIONER	XXE (XML External Entity)	Abrir
Exploiting XXE via image file upload	PRACTITIONER	XXE (XML External Entity)	Abrir

​

Rooms TryHackMe que practican XML External Entity (4)

Room	Dificultad	Tipo	Acceso	Oficial
Advent of Cyber 2024	EASY	Walkthrough	🟢 Free	Abrir
GeoServer: CVE-2025-58360	MEDIUM	Walkthrough	🟢 Free	Abrir
NahamStore	MEDIUM	Challenge	🟢 Free	Abrir
XXE Injection	MEDIUM	Walkthrough	🔵 VIP	Abrir

​

Skills relacionadas

• /skills/lfi
• /skills/ssrf

---

← Volver al glosario completo

Última actualización: 2026-05-09