W-XXE-SSRFLateral Movement

XXE → SSRF

Use SYSTEM "http://internal" entity to make the XML parser fetch internal URLs.

§ Where this technique fits

W-XXE-SSRF is catalogued under the Lateral Movement tactic of the offensive-security kill-chain. It appears in 1 approved dossier in the registry, typically at step 3 on average.

§ Dossiers chaining this technique

XXE → SSRF → IMDS → cloud creds
XML parser configured with external entities resolution. Use XXE to make the server hit IMDS and exfiltrate cloud credentials via DTD trickery.
step 3 / 6

§ What commonly comes next

01
SSRF → Cloud IMDS
W-SSRF-IMDS · Lateral Movement
seen 1×

§ Where this technique fits

§ Dossiers chaining this technique

XXE → SSRF → IMDS → cloud creds

§ What commonly comes next