Forcing XXE Reflection through Server Error Messages

Cody Wass recounts discovering an XXE vulnerability in a service behind IBM's MaaS360 MDM platform, with a primer on external XML entities and how parser abuse enables file reads and SSRF.

A practical guide to testing SSO solutions that use SAML, covering the IdP/SP message flow and common implementation mistakes involving signatures, assertions, and message expiration.

By switching a JSON request's Content-Type to application/xml, testers can sometimes reach an unanticipated XML parser on the server and trigger XXE, enabling file reads, UNC access, or SSRF.

Burp Suite Pro's scanner now detects blind XXE injection by defining external entities referencing Collaborator URLs, confirming out-of-band interactions that response-based checks missed.

The ultimate XXE guide: abusing XML parser entity handling for file disclosure, internal reconnaissance, cloud metadata theft — even via DOCX uploads — and RCE in some configurations.

hakluke explains why XXE is severe and often missed by automated scanners. The guide covers XML entities and how XXE enables arbitrary file reads, SSRF, DoS, and sometimes RCE.