[ernestmiller]

Wanted to know how to validate quickly whether an XML injection is a false positive or not.

For example if Burpsuite throws up some XML injections that are possble.

Obviously you would at first check the HTTP Headers of the request and check if the website really is parsing or Accepting XML to begin with

[Most annoying process]

Feel free to PM me for help with this. I have experience.

[frank3nstien]

XML and XPath false positives when it finds certain strings (e.g. xmlschema, ajaxpath) in the the response of burp scans, but it does not consider when those same strings were already present in the original response to unaltered requests.