| name | hunt-xxe |
| description | Investigate authorized XML external entity and XML parser boundaries. Use when typed discovery identifies XML or SOAP request bodies, document imports, XML or SVG uploads, DOCTYPE handling, entity-resolution behavior, parser errors, or a suspected external-entity primitive. |
Hunt XML Entity Boundaries
Treat this card as advisory prioritization. XML syntax, parser errors, and DOCTYPE support are not
proof of entity resolution.
Workflow
- Preserve a well-formed, target-observed XML request as the baseline.
- Pair a bounded entity candidate with a same-shape unresolved control. A native result without
that replay remains an exploit primitive, not a verified vulnerability.
- Use
xxe_boundary; use file_fetch_parser only for a typed upload or import. Its fixed local-file
candidates must all be authorized.
- Separate parsing, resolution, readback, and outbound behavior. Preserve redacted controls and
evidence references, and report validated vulnerabilities without requiring a challenge artifact.
Evidence Gate
Confirm only replayable entity-derived readback or a controlled interaction absent from the paired
control. Reflected declarations, accepted syntax, errors, and timing remain observations. Keep any
contract_missing result suspected rather than promoting it.
Stop Conditions
Stop without a typed parser, replay, unambiguous control, or policy budget. Do not add entity bombs,
file targets, or out-of-band services beyond the authorized native set.
