hunt-xxe

To test for XXE vulnerabilities, inject an inline DOCTYPE with an ENTITY into XML input and observe whether the payload expands or triggers external callbacks. Repeating this with blind payloads and logging outbound interactions confirms the vulnerability.

Blind XXE occurs when an XML parser processes external entities but returns no direct response. Out-of-band exfiltration works by using DTD-based payloads to force the parser to send sensitive data to an attacker-controlled external callback endpoint.

Yes, testing SOAP and OOXML endpoints with external entity payloads can reveal SSRF-like paths. By injecting DTD-based payloads, you can force the XML parser to make outbound requests, confirming server-side request forgery chains.

Yes, this approach applies to SVG and XML-in API workflows. It analyzes external entity expansion behavior across common XML processing paths to detect in-band file reads or blind out-of-band data exfiltration in these formats.

The best way to verify blind out-of-band callbacks is by injecting blind payloads into the target XML input and logging any outbound DNS or HTTP interactions. This OOB callback verification confirms the XXE impact without requiring direct application responses.

Avoid inline entity probes when the target parser is hardened against external entity expansion, as they will fail to trigger in-band reads. In these cases, blind DTD-based payloads and out-of-band callback verification are required to confirm parser hardening and mitigation effectiveness.