domains / families / security / testing-for-xxe-injection-vulnerabilities

testing-for-xxe-injection-vulnerabilities

separate

Discovering and exploiting XML External Entity injection vulnerabilities

When to use

• During authorized penetration tests when the application processes XML input (SOAP APIs, file uploads, RSS feeds)
• When testing APIs that accept `Content-Type: application/xml` or `text/xml`
• For assessing XML parsers in file upload functionality (DOCX, XLSX, SVG, PDF)
• When evaluating SOAP-based web services for entity injection
• During security assessments of enterprise applications using XML configuration

Skill page

Source