Professional 1.6.26
Summary: PortSwigger's Burp Suite release on 2 September 2015 added detection of blind server-side XML/SOAP injection by triggering interactions with Burp Collaborator. The scanner sends payloads using schema location and XInclude to make the server-side XML parser reach the Collaborator server, then reports an issue based on observed DNS or HTTP interactions, a technique the release says works even when the parameter value contains no XML and nothing in the request or response indicates XML/SOAP is in use.
Key Takeaway: The release states this technique is effective even when there is no indication in the request or response that XML/SOAP is being used server-side, so an injection path can exist in traffic that looks entirely unrelated to XML.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026