XXE testing (XML external entity injection)
XML external entity (XXE) injection is when your XML parser resolves attacker-defined external entities — letting them read local files, reach internal services or exfiltrate data out-of-band. Sintropyc tests every endpoint that parses XML and proves each finding with real file contents or a server-side callback.
What XXE lets an attacker do
- Read local files —
/etc/passwd, your app config and secrets, via a file entity - SSRF — make the parser fetch internal URLs and cloud metadata (see SSRF testing)
- Out-of-band exfiltration — stream file contents to an attacker server when nothing is reflected (blind XXE)
- Denial of service — the classic 'billion laughs' entity expansion
Where XML still hides in a JSON world
APIs look like JSON, but XML is everywhere underneath: SOAP endpoints, SAML SSO assertions, file uploads (DOCX, XLSX and SVG are XML), RSS and sitemap importers, and any 'legacy' or integration endpoint. A parser left in its default, entity-resolving configuration is all it takes.
Many XML libraries resolve external entities by default. The fix is one line — disable DTDs and external entities — but only if someone knows the endpoint parses XML at all. Sintropyc finds the ones nobody remembered.
How Sintropyc tests it
Sintropyc is an autonomous AI penetration testing agent. It signs in as real users across different roles, drives your product the way a customer would, and proves every finding with a working exploit — never a scanner guess. Each finding is checked by a human before it reaches you, comes with the exact fix, and is attacked again after you ship it to confirm it held.
For XXE, Sintropyc submits crafted XML (and XML-backed uploads like SVG and DOCX) to every parsing endpoint, defining entities that either return a known local file or call a unique out-of-band canary. A finding is reported only when the parser actually resolves the entity — proven with the returned file or the server-side callback.
What you get
- Every XML, SOAP, SAML and XML-backed upload endpoint tested
- Each finding proven by real file read or an out-of-band callback (including blind XXE)
- SSRF and file-read impact attributed per finding
- The fix (disable DTDs / external entities) and a retest
Common questions
We're a JSON API — are we affected?
Possibly. SAML SSO, file uploads (SVG / Office docs), SOAP and integration endpoints all parse XML even in a JSON-first app. Sintropyc checks the ones that do.
How do you prove blind XXE?
With an out-of-band canary — the parser is told to fetch or exfiltrate to a unique endpoint. If it calls the canary, the XXE is real even when nothing comes back in the response.
Do you test the 'billion laughs' DoS?
We identify the exposure but demonstrate it safely — we don't actually run a denial-of-service against your server. Any load testing is only with explicit agreement.