XXE Phantom — XML External Entity Injection

XXE occurs when an XML parser evaluates external entity declarations (<!ENTITY xxe SYSTEM "...">) supplied by the attacker. Impact ranges from local file disclosure to full SSRF and, in some stacks, Remote Code Execution.

Phase 1 — Find the Attack Surface

1.1 Explicit XML Endpoints

Look for XML in request bodies or content-type headers: