Lab: Blind XXE with out-of-band interaction via XML parameter entities
Summary: This PortSwigger lab features a "Check stock" feature that parses XML input but displays no unexpected values and blocks requests containing regular external entities. The exercise requires using a parameter entity to make the XML parser issue a DNS lookup and HTTP request to Burp Collaborator, with the external entity definition inserted between the XML declaration and the stockCheck element.
Why it matters: The lab's premise is that blocking regular external entities is not enough: a parser that still resolves parameter entities will still reach out to an attacker-controlled host, and the lab firewall blocks interactions with arbitrary external systems, so only Burp Collaborator's default public server works.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026