hunt-xxe

What problem does it solve?

XXE vulnerabilities can let attackers coerce a vulnerable XML parser into reading sensitive files, triggering out-of-band callbacks, or reaching internal services via SSRF.

Core Features & Use Cases

• Hunt for XXE entry points: Map XML-related endpoints by paths, headers, and client-side parsing hints, then focus testing where the target actually consumes XML.
• Validate impact quickly: Run in-band payloads for file disclosure, escalate to blind out-of-band (DNS/HTTP) when reflection is blocked, and then confirm SSRF to internal destinations such as cloud instance metadata.
• Produce a defensible report chain: Document the exploit path (file read → SSRF → internal access) and apply reproducibility and severity gates so findings are triage-ready.
• Use cases: XML APIs, SOAP/WSDL services, SAML/SSO endpoints, and server-side document processing (DOCX/XLSX/SVG and similar) where XML parsing may be hidden inside uploads or conversions.

Quick Start

Use the hunt-xxe skill against the target and verify an XXE impact path by testing a known XML endpoint and attempting a short in-band entity payload for file disclosure or, if blocked, a blind OOB callback.