Testing for XXE Injection Vulnerabilities

When to Use

• During authorized penetration tests when the application processes XML input (SOAP APIs, file uploads, RSS feeds)
• When testing APIs that accept Content-Type: application/xml or text/xml
• For assessing XML parsers in file upload functionality (DOCX, XLSX, SVG, PDF)
• When evaluating SOAP-based web services for entity injection
• During security assessments of enterprise applications using XML configuration

Prerequisites

• Authorization: Written penetration testing agreement for the target
• Burp Suite Professional: For intercepting and modifying XML requests
• XXEinjector: Automated XXE exploitation tool (git clone https://github.com/enjoiz/XXEinjector.git)
• Out-of-band server: Burp Collaborator or interactsh for blind XXE detection
• curl: For manual payload crafting and submission
• Python: For building DTD hosting server