Detect and triage XXE vulnerabilities in XML processing pipelines.
npx skills add https://github.com/riparino/Claude-Cyber --skill defensive-xxe
Please help me install this Agent Skill. Skill: defensive-xxe Source: https://github.com/riparino/Claude-Cyber/tree/main/Claude-Blue/Skills/defensive-xxe Command: npx skills add https://github.com/riparino/Claude-Cyber --skill defensive-xxe
XML processing often exposes applications to XXE vulnerabilities via DOCTYPE and ENTITY definitions. This skill provides a structured approach to detect and triage XXE indicators in XML inputs, enabling faster remediation.
Load the XXE detection methodology into the XML processing pipeline to identify DOCTYPE/ENTITY patterns and OOB callbacks.
High-intent search queries and answers about installing and using this skill.
Detect XXE vulnerabilities by identifying DOCTYPE and ENTITY definitions, out-of-band callback patterns, and file read attempts. This approach applies Sigma rules, YARA patterns, and KQL queries to triage malicious XML inputs in web services and applications.
Sigma rules for XML injection and YARA patterns for XXE payloads identify DOCTYPE and ENTITY usage. These rules detect malicious XML inputs, enabling SOC teams to monitor and alert on XML External Entity injection attempts during processing.
Monitor Azure WAF and MDE network telemetry for XXE callbacks using KQL queries. These queries identify out-of-band callback patterns and file read attempts, providing visibility into XML External Entity exploitation across web services and network traffic.
Yes, this XXE detection applies to web services and applications that parse XML. It triages XML inputs by identifying DOCTYPE and ENTITY patterns, OOB callbacks, and file read attempts, enabling SOC teams to harden XML parsers.
The best way to harden XML parsers against DOCTYPE and ENTITY definitions is to apply structured detection rules. By deploying Sigma, YARA, and KQL queries, SOC teams can identify XXE indicators and implement monitoring to alert on malicious XML processing.
Use KQL queries to triage XML External Entity attacks because they query Azure WAF and MDE network telemetry. This identifies out-of-band callbacks and file read attempts, enabling SOC teams to detect and respond to XXE vulnerabilities across network infrastructure.
EntroVyxMap XML entry points and test for in-band or blind OOB data exfiltration.
riparinoCorrelate web, WAF, and database logs to detect SQL injection attempts.
copyleftdevCreate portable YARA and Sigma threat detection rules for malware hunting.
Kisilev13Detect and exploit XML External Entity vulnerabilities in XML parsers.
