SSRF and XML External Entity Processing
Make the server fetch or parse for you
SSRF appears wherever the server retrieves a URL you influence: image fetchers, webhooks, PDF renderers, URL previews, importers, and proxy endpoints. First establish whether responses come back (full SSRF) or only timing and errors (blind). Then test filter bypasses: localhost, 127.0.0.1, 127.1, decimal 2130706433, octal, IPv6 [::1], DNS names resolving to loopback, redirects from an allowed host, and DNS rebinding. Cloud metadata (169.254.169.254) is the classic high-value target; note that modern clouds require a token header, so check whether you control headers too. gopher:// gives you raw TCP when the client library allows it, enabling protocol smuggling to internal services such as Redis or SMTP.
XXE requires an XML parser with external entities enabled. Basic payloads define an external entity pointing at file:///etc/passwd or an internal URL; blind cases need out-of-band DTDs served over HTTP or FTP, or error-based leakage. Parameter entities (%entity;) are needed inside DTDs; PHP's expect:// wrapper can turn XXE into command execution. Remember that XML arrives through more than SOAP: SVG images, DOCX/XLSX uploads, RSS importers, and SAML assertions all parse XML.
Traps: assuming libxml disables entities by default (true in modern PHP, false in older versions); testing only the body when the parser also reads a Content-Type or SOAPAction; and forgetting that an internal fetch returning a custom error still proves SSRF.
Rule of thumb: for SSRF, prove reachability with a collaborator callback first, then escalate to internal addresses and metadata; for XXE, always try an out-of-band DTD before concluding it is safe.