Testing for XXE – where to find it, and how to verify it

As we discussed previously, none of the inputs available to you need to state that the application accepts XML for a service to be vulnerable to XXE: the XML parsing layer of the application could be opaque to you, stitching together data that you sent as a GET or POST request into an XML document.

Besides services that use XML as their primary document formatting system under-the-hood, there are also many API services that support different data formats by default. Even if you're making a GET request and receiving JSON in return, you can test whether or not that API endpoint can format your request as XML by trying the XML content header, that is, Content-Type: application/xml. Because services often have this capacity to switch between different content types that are built-in, the owner of the service might...