XXE in IBM's MaaS360 Platform

Covers an out-of-band XXE technique that uses an external DTD hosted on an attacker server to exfiltrate local files when the vulnerable application does not reflect responses.

By switching a JSON request's Content-Type to application/xml, testers can sometimes reach an unanticipated XML parser on the server and trigger XXE, enabling file reads, UNC access, or SSRF.

A practical guide to testing SSO solutions that use SAML, covering the IdP/SP message flow and common implementation mistakes involving signatures, assertions, and message expiration.

Burp Suite Pro's scanner now detects blind XXE injection by defining external entities referencing Collaborator URLs, confirming out-of-band interactions that response-based checks missed.

The ultimate XXE guide: abusing XML parser entity handling for file disclosure, internal reconnaissance, cloud metadata theft — even via DOCX uploads — and RCE in some configurations.

Oracle Database's XML parser (11.2.0.3-12.1.0.2) resolves external schemas, so XXE via extractvalue() lets a CREATE SESSION holder exfiltrate data over HTTP/FTP, port-scan, or trigger SSRF.