testing-for-xxe-injection-vulnerabilities

# Testing for XXE Injection Vulnerabilities ## When to Use - During authorized penetration tests when the application processes XML input (SOAP APIs, file uploads, RSS feeds) - When testing APIs that accept `Content-Type: application/xml` or `text/xml` - For assessing XML parsers in file upload functionality (DOCX, XLSX, SVG, PDF) - When evaluating SOAP-based web services for entity injection - During security assessments of enterprise applications using XML configuration ## Prerequisites - **Authorization**: Written penetration testing agreement for the target - **Burp Suite Professional**: For intercepting and modifying XML requests - **XXEinjector**: Automated XXE exploitation tool (`git clone https://github.com/enjoiz/XXEinjector.git`) - **Out-of-band server**: Burp Collaborator or interactsh for blind XXE detection - **curl**: For manual payload crafting and submission - **Python**: For building DTD hosting server ## Workflow ### Step 1: Identify XML Processing Points Find all application endpoints that accept or process XML data. ```bash # Look for XML content types in Burp proxy history # Filter for: Content-Type: application/xml, text/xml, application/soap+xml # Test if JSON endpoints also accept XML # Original JSON request: curl -s -X POST \ -H "Content-Type: application/json" \ -d '{"search":"test"}' \ "https://target.example.com/api/search" # Try converting to XML: curl -s -X POST \ -H "Content-Type: application/xml" \ -d '<?xml version="1.0"?><...