References & Resources

Authoritative resources, standards, tools, and documentation for understanding and preventing XXE vulnerabilities.

Official Standards & Organizations

OWASP XXE Processing

OWASP community page on XXE vulnerabilities

https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing

OWASP XXE Prevention Cheat Sheet

Comprehensive prevention guide from OWASP

https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html

CWE-611: Improper Restriction of XML External Entity Reference

Official CWE database entry for XXE

https://cwe.mitre.org/data/definitions/611.html

OWASP Top 10:2021 - A05: Security Misconfiguration

XXE is categorized under security misconfiguration

https://owasp.org/Top10/A05_2021-Security_Misconfiguration/

Educational Resources

PortSwigger Web Security Academy - XXE

Comprehensive tutorial with interactive labs

https://portswigger.net/web-security/xxe

PortSwigger XXE Labs

Hands-on practice labs for XXE exploitation

https://portswigger.net/web-security/all-labs#xml-external-entity-xxe-injection

Acunetix XXE Guide

Detailed explanation of XXE vulnerabilities

https://www.acunetix.com/blog/articles/xml-external-entity-xxe-vulnerabilities/

Snyk Learn - XXE

Interactive XXE lessons and examples

https://learn.snyk.io/lesson/xxe/

Research Papers & Articles

XML External Entity (XXE) Injection

Deep dive into XML entities and exploitation

https://portswigger.net/web-security/xxe/xml-entities

Exploiting XXE Vulnerabilities in ICS/SCADA Systems

Advanced XXE exploitation techniques (PDF)

https://www.blackhat.com/docs/us-15/materials/us-15-Wang-FileCry-The-New-Age-Of-XXE-java-wp.pdf

Language-Specific Documentation

Java XML Processing Security

Official Oracle documentation on secure XML processing

https://docs.oracle.com/javase/tutorial/jaxp/properties/properties.html

Python defusedxml Library

Secure XML processing library for Python

https://github.com/tiran/defusedxml

PHP libxml Security

PHP documentation on disabling entity loading

https://www.php.net/manual/en/function.libxml-disable-entity-loader.php

Node.js XML Parser Security

Secure XML parsing for Node.js

https://github.com/libxmljs/libxmljs

Tools & Scanners

Burp Suite

Web security testing tool with XXE detection

https://portswigger.net/burp

OWASP ZAP

Free security scanner with XXE checks

https://www.zaproxy.org/

XXEinjector

Automated XXE exploitation tool

https://github.com/enjoiz/XXEinjector

CVE Databases

NIST NVD - XXE Vulnerabilities

National Vulnerability Database XXE CVEs

https://nvd.nist.gov/vuln/search/results?form_type=Basic&results_type=overview&query=XXE&search_type=all

CVE Details - CWE-611

Historical XXE vulnerability data

https://www.cvedetails.com/cwe-details/611/Improper-Restriction-of-XML-External-Entity-Reference.html

Missing a Resource?

If you know of an authoritative resource that should be included on this page, please consider contributing to the project or reaching out with suggestions.