https://coreyfarley.com/tags/portswigger/ Recent content in PortSwigger on Corey Farley Hugo en-us Wed, 23 Sep 2026 00:00:00 +0000 https://coreyfarley.com/posts/xxe-explained/ Wed, 23 Sep 2026 00:00:00 +0000 https://coreyfarley.com/posts/xxe-explained/ A full breakdown of XML External Entity (XXE) injection — what it is, the XML internals that make it possible, where the attack surface hides, and every major exploitation path from basic in-band file reads to blind out-of-band exfiltration via malicious external DTDs, SSRF against cloud metadata, error-based leaks, XInclude, and SVG file upload vectors.