XXE Detection

When to Use

Audit XML processing endpoints, SOAP services, document importers (DOCX/XLSX/SVG), and any code that parses XML from untrusted sources.

Key Distinction from Entity Expansion

• XXE = EXTERNAL entities (file://, http://) -- reads files or makes HTTP requests
• Entity expansion = INTERNAL entity recursion (Billion Laughs) -- memory exhaustion DoS

Both can exist in the same parser, but they are different vulnerabilities.

Process

Step 1: Find XML Parsers