---
id: 8215
title: "Playing with Content-Type – XXE on JSON Endpoints"
source_domain: netspi.com
source_url: "https://www.netspi.com/blog/technical-blog/web-application-pentesting/playing-content-type-xxe-json-endpoints/"
published_at: "2015-04-20T00:00:00Z"
tags: ["pentesting", "web-security", "ssrf", "json", "xxe", "xml", "content-type"]
phying_url: "https://phying.com/item/8215"
lang: en
---

# Playing with Content-Type – XXE on JSON Endpoints

## Summary

By switching a JSON request's Content-Type to application/xml, testers can sometimes reach an unanticipated XML parser on the server and trigger XXE, enabling file reads, UNC access, or SSRF.

## Intelligence Metadata

- **Sources:** netspi.com
- **Published:** 2015-04-20T00:00:00Z
- **Original:** https://www.netspi.com/blog/technical-blog/web-application-pentesting/playing-content-type-xxe-json-endpoints/
- **Phying News:** https://phying.com/item/8215