OWASP Hunting
Injection

XML Injection

XML injection manipulates XML parsers by inserting special characters or well-formed XML to modify application behavior or extract data.

These payloads are for authorized testing only — systems you own, authorized bug bounty programs, or controlled lab environments. Unauthorized testing is illegal.

What it is

XML Injection occurs when an attacker injects XML syntax into user-supplied input that is embedded in an XML document or SOAP message. This can modify the structure of the XML, bypass input validation, cause denial of service (XML bomb), or enable XXE (XML External Entity) attacks.

Attack Vectors

  • SOAP web service endpoints
  • XML-based REST API payloads
  • File import functionality accepting XML
  • Configuration fields stored as XML
  • RSS/Atom feed processors

Testing Methodology

  1. Submit XML special characters: <, >, &, ', " to test for parsing errors
  2. Attempt to close an XML tag and inject a new element
  3. Test for XML bomb (billion laughs) to check resource limits
  4. Test for XXE if the parser supports external entity processing

Payloads

Reference payloads for authorized testing. Always verify you have permission before use.

Basic Probes
<>&'"]]><![CDATA[<injected>]]>
Tag Injection
</name><admin>true</admin><name><name>test</name><role>admin</role>test</data><injected>1</injected><data>
XML Bomb (DoS)
<?xml version="1.0"?><!DOCTYPE bomb [<!ENTITY a "aaaaaaaaaa"><!ENTITY b "&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;"><!ENTITY c "&b;&b;&b;&b;&b;&b;&b;&b;&b;&b;">]><bomb>&c;</bomb>

Indicators of Vulnerability

  • XML parsing errors in response when injecting special characters
  • Modified application behavior when closing/injecting XML tags
  • Server hanging or out-of-memory error with XML bomb payload

Detection Guidance

Use XML schema validation on all incoming XML data. Disable DTD processing and external entity resolution. Monitor for XML parsing errors in application logs.

Mitigation & Remediation

  • Validate XML input against a strict XSD schema
  • Disable DTD processing and external entity loading
  • Encode user input before embedding in XML documents
  • Set resource limits on XML parser to prevent DoS

References

Responsible Use

All content in this reference is for authorized security testing only. Use only on systems you own or have explicit written permission to test.

  • Systems and applications you own
  • Authorized penetration testing engagements
  • Bug bounty programs with defined scope
  • Educational lab environments (DVWA, WebGoat, HackTheBox)