# Resources

{% embed url="https://portswigger.net/web-security/xxe" %}

{% embed url="https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing" %}

{% embed url="https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html" %}

{% embed url="https://book.hacktricks.xyz/pentesting-web/xxe-xee-xml-external-entity" %}

{% embed url="https://www.synack.com/blog/a-deep-dive-into-xxe-injection/" %}

{% embed url="https://blog.netspi.com/forcing-xxe-reflection-server-error-messages/" %}



* OWASP [XML External Entity (XXE) Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)
* [Timothy Morgan’s 2014 Paper: XML Schema, DTD, and Entity Attacks - A Compendium of Known Techniques](http://www.vsecurity.com/download/papers/XMLDTDEntityAttacks.pdf)
* [Precursor presentation of above paper - at OWASP AppSec USA 2013](http://2013.appsecusa.org/2013/wp-content/uploads/2013/12/WhatYouDidntKnowAboutXXEAttacks.pdf)
* [CWE-611: Information Exposure Through XML External Entity Reference](https://cwe.mitre.org/data/definitions/611.html)
* [CWE-827: Improper Control of Document Type Definition](https://cwe.mitre.org/data/definitions/827.html)
* [Sascha Herzog’s Presentation on XML External Entity Attacks - at OWASP AppSec Germany 2010](https://www.owasp.org/images/5/5d/XML_Exteral_Entity_Attack.pdf)
* [PostgreSQL XXE vulnerability](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3489)
* [SharePoint and DotNetNuke XXE Vulnerabilities, in French](http://www.agarri.fr/kom/archives/2011/09/15/failles_de_type_xee_dans_sharepoint_et_dotnetnuke/index.html)
* [XML Denial of Service Attacks and Defenses (in .NET)](https://msdn.microsoft.com/en-us/magazine/ee335713.aspx)
* [Early (2002) BugTraq Article on XXE](http://www.securityfocus.com/archive/1/297714/2002-10-27/2002-11-02/0)
* [http://www.synacktiv.fr/ressources/synacktiv\_drupal\_xxe\_services.pdf](http://www.synacktiv.fr/ressources/synacktiv_drupal_xxe_services.pdf)
