---
id: 937
title: "How to Find XXE Bugs: Severe, Missed and Misunderstood"
source_domain: bugcrowd.com
source_url: "https://www.bugcrowd.com/blog/how-to-find-xxe-bugs/"
published_at: "2021-02-19T00:00:00Z"
tags: ["bug-bounty", "rce", "web-security", "exploitation", "tutorial", "ssrf", "xxe", "xml"]
phying_url: "https://phying.com/item/937"
lang: en
---

# How to Find XXE Bugs: Severe, Missed and Misunderstood

## Summary

hakluke explains why XXE is severe and often missed by automated scanners. The guide covers XML entities and how XXE enables arbitrary file reads, SSRF, DoS, and sometimes RCE.

## Intelligence Metadata

- **Sources:** bugcrowd.com
- **Published:** 2021-02-19T00:00:00Z
- **Original:** https://www.bugcrowd.com/blog/how-to-find-xxe-bugs/
- **Phying News:** https://phying.com/item/937