Web services are essential for online interactions, supporting critical tasks like banking and shopping, but their importance also makes them prime targets for attacks. Attackers try to manipulate data injecting malicious code, potentially compromising systems. Current approaches to preventing such attacks use techniques like attack grammars, symbolic execution, or machine learning to detect vulnerabilities or manually embed malicious payloads, that can miss parts of the service under test.

In this paper, we propose XAVIER, a framework for detecting XML injection vulnerabilities. By leveraging the WSDL specification of a web service, XAVIER crafts XML messages that reflect the service’s functionality, enabling the examination of web services for XMLi vulnerabilities. Results show that XAVIER performs equally, or better than the state-of-the-art tool, SOAP UI PRO. Compared to the latter, XAVIER is open source and extensible, providing a platform for future research in the field.