Lab: Blind XXE with out-of-band interaction
Summary: PortSwigger's lab presents a "Check stock" feature that parses XML input but does not display the result, making the XXE vulnerability blind. The lab is solved by defining an external entity between the XML declaration and the stockCheck element that makes the parser issue a DNS lookup and HTTP request to a Burp Collaborator subdomain, which must be on Collaborator's default public server because the Academy firewall blocks interactions with arbitrary external systems.
What's compelling: A parser that returns nothing to the attacker can still be confirmed through out-of-band DNS and HTTP callbacks, so a feature that looks silent in your application logs may already be exfiltrating data to an external domain.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026