thinQtankLABS

Web App XXE: Find, Confirm & Fix (Basic)

Hands-on with XML External Entity (XXE) (CWE-611) in Acme Invoicing's XML import feature. Safely reproduce it with an inert training tool (no working exploit), classify it, score it with CVSS, then apply the correct fix and verify.

Beginner 20 guided steps 5 tasks About 55 minutes Runs in your browser

Skills you will practice

  • Secure web application concepts; XML External Entity (XXE) identification and prioritization; Web application testing; Disable DTDs/external entities

Certifications this lab maps to

This lab builds hands-on skills that appear on these certification exams. thinQtank Learning runs instructor-led training camps for each — click one to see upcoming classes.

CompTIA Security+ SY0-701 Secure web application concepts Training at thinQtank Learning CompTIA CySA+ CS0-003 Vulnerability identification and prioritization Training at thinQtank Learning CompTIA PenTest+ PT0-003 Web application testing Training at thinQtank Learning
Part of these certification lab packages: Security+ SY0-701 CySA+ CS0-003 PenTest+ PT0-003 Certified in Cybersecurity (CC) GSEC GSEC GPEN GPEN

The scenario

A penetration test flagged Acme Invoicing's XML import feature as XML External Entity (XXE) (CWE-611). You are the app-security engineer. Start by understanding it.

What you will do

  1. Understand the feature and the finding4 steps

    Open the engagement · Read the finding · Which weakness class? · Read the feature config

  2. Reproduce it safely5 steps

    Parse a normal document · Read the XXE payload · Parse the payload and capture · Review the evidence · …

  3. Assess the severity4 steps

    Find the CVSS vector · Compute the base score · What is the base score? · Why this severity?

  4. Fix it4 steps

    Which fix is right? · Baseline scan · Apply the fix · Confirm the config

  5. Verify3 steps

    Verify with a scan · If it was already exploited? · Document the work

How this lab works

A real Linux-style console. Commands run against real files, so hashes, hex dumps and comparisons give real results.

A file browser where you can place evidence into the lab, either the file provided or one of your own.

Reset a single step, a whole task or the entire lab. The environment is rebuilt so you can try again cleanly.

Progress saves after every step. Close the tab and come back later; your files and answers are waiting.