Generic Blind XXE Injection Vulnerability Scanner

External entity injection (also known as XXE) is a web security vulnerability that allows an adversary to disrupt an application's processing of XML data. It typically lets attackers access files on the app server's filesystem and contact any back-end or external systems accessible through the application.

An attacker may use an XXE vulnerability to launch a server-side request forgery (SSRF) attack on the underlying server or other back-end infrastructure, leveraging the XXE flaw to gain access.

Blind XXE vulnerabilities occur when the software is vulnerable to XXE injection but does not return any of the values defined by external entities in its responses. This implies that direct access to server-side files is not feasible, and blind XXE is more difficult to exploit than usual XXE flaws.

Blind XXE vulnerabilities may be found and exploited in a variety of ways, but there are two main approaches:

• You can generate out-of-band network interactions that may exfiltrate sensitive data inside the interaction data.
• It's possible to cause XML parsing failures in such a way that the error messages include sensitive data.