XXE Testing Methodology

Overview

XXE allows attackers to interfere with XML processing, potentially reading files, performing SSRF, or DoS.

Types

1. In-band XXE: Direct response with data
2. Blind XXE: Use out-of-band callbacks
3. Error-based XXE: Extract data via error messages

Payloads