XXE hunting

Playbooks

• XXE Injection - Abuse XML external entity parsing to read files, perform SSRF, or exfiltrate data out-of-band.
• SAML / SSO Attacks - SAML is XML plus cryptography plus a pile of libraries that disagree. Signature wrap and XXE still show up.

Gadgets

• XML external entity / DTD fetch - A parser that loads a DTD from a URL you control is at least SSRF. File read and billion-laughs are extra, not the first proof.
• SAML ACS / recipient confusion - If the SP accepts an assertion meant for another ACS, or does not bind Recipient / Audience / Destination, you mint a session.

Payloads

• XML External Entity - Classic file read via inline entity; blind exfiltration via an external DTD you host. Also works through SVG and Office (docx/xlsx) uploads. Avoid billion-laughs on prod - it's a DoS.
• Blind XXE with OAST - For an authorized XML parser assessment, use an external entity that resolves only to a controlled callback and proves parser behavior without reading local files or reaching internal networks.
• SAML assertion probes - Lab or test-tenant only. Recipient, Audience, Destination, and comment wrapping. Pair with the XXE canary on the same ACS parser.

Bypasses

• XXE parser still fetches - Prove the parser resolves an external identifier with a canary. Do not file-read or hit metadata first.
• SAML ACS and wrapping - Test on an IdP/SP pair you control or a program test tenant. Signature wrapping and Recipient mismatch are parser bugs.

Tools

• interactsh - Out-of-band interaction gathering (OOB/OAST). Catches blind SSRF, RCE, and XXE via DNS/HTTP callbacks. Self-hostable.

Questions

File read or canary?

Canary first. File read only if policy allows a harmless path, and never other customers' data.

Where does XXE still live?

SAML ACS, OOXML preview, SOAP, SVG, RSS, XML backups. JSON APIs that still accept application/xml.

This page is the public form of hunt_brief("xxe") on the MCP connector. Authorized testing only.