skills.rest
baiqigo
baiqigoCOMMUNITY
Explore all skills by this author →
GitHub

hunt-xxe

Guides evidence-gated hunting of XXE vulnerabilities across XML endpoints, file uploads, and SAML services.

10|3|Updated Aug 10, 2026
Search Tags:#security testing#xml#ssrf#bug bounty#web vulnerabilities#xxe#oob exfiltration
One-click install
npx skills add https://github.com/baiqigo/baiqi-redteam-lab --skill hunt-xxe-baiqigo
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-xxe
Source: https://github.com/baiqigo/baiqi-redteam-lab/tree/main/.agents/skills/hunt-xxe
Command: npx skills add https://github.com/baiqigo/baiqi-redteam-lab --skill hunt-xxe-baiqigo

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? It gives security researchers a structured methodology for finding and validating XML External Entity (XXE) vulnerabilities during authorized bug bounty testing, replacing ad-hoc payload guessing with a repeatable, evidence-gated workflow. ## Core Features & Use Cases - Attack Surface Mapping: Identifies XML entry points via URL patterns, Content-Type headers, JavaScript parsing calls, and tech-stack fingerprints across Java, PHP, Python, Ruby, and .NET stacks. - Payload Library & Bypass Techniques: Provides in-band file read, blind OOB parameter-entity DTD exfiltration, SSRF-via-XXE, SVG/DOCX/PPTX upload payloads, plus WAF and egress-filter bypass methods. - Parser Vulnerability Matrix & Validation Gates: Includes a parser-ecosystem matrix to fingerprint whether a target is exploitable, plus Gate 0 checks requiring demonstrated file read, OOB data exfiltration, or internal SSRF before reporting. - Use Case: While testing a target's document upload feature, upload a crafted SVG with an external entity, confirm a Burp Collaborator callback, escalate to parameter-entity exfiltration of /etc/passwd, and document a reproducible curl command for the triage report. ## Quick Start Use the hunt-xxe skill to plan an evidence-gated XXE validation path against my authorized target's XML endpoints and file upload features.

Frequently Asked Questions about hunt-xxe

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test for blind XXE vulnerabilities?▼

Blind XXE testing uses an out-of-band listener such as Burp Collaborator or interactsh. Inject an external entity pointing to your callback URL, confirm the DNS or HTTP hit, then escalate with a two-stage parameter-entity DTD payload to exfiltrate file contents over HTTP or DNS.

How do I find XXE in file upload features?▼

Upload XML-based formats like SVG, DOCX, XLSX, or PPTX and observe server-side processing. Embed a DOCTYPE with an external entity in the SVG text element or inside the OOXML parts such as word/document.xml, then check for reflected content or OOB callbacks.

Which XML parsers are vulnerable to XXE by default?▼

Java SAX/DOM without hardening, PHP DOMDocument with LIBXML_NOENT, older .NET XmlDocument with XmlResolver, and legacy Struts are vulnerable by default. Python xml.etree, modern lxml, defusedxml, and default Nokogiri disable external entities and are generally safe.

Can JSON APIs be vulnerable to XXE?▼

Yes. Some REST APIs that nominally accept JSON also parse requests sent with Content-Type application/xml. Swap the content type, submit an equivalent XML body with an entity payload, and watch for reflection or OOB callbacks to confirm the hidden XML parser.

Why does my XXE payload only trigger a DNS callback with no data?▼

A DNS-only callback proves the parser fetches external entities but not that data can be exfiltrated. Escalate with a parameter-entity DTD that reads a local file and sends it via HTTP, or use error-based exfiltration; without demonstrated data exposure, severity is Low to Medium.

How do I bypass WAF blocking of XXE payloads?▼

Common bypasses include UTF-16 encoding the entire payload, case variation on DOCTYPE and ENTITY keywords, chunked transfer encoding, XML comments breaking signatures, and alternative URI schemes like php://filter, netdoc://, or jar:// when file:// is blocked.

Related Skills

Explore More Software Engineering Skills→
cybersecwomancybersecwoman
5

hunt-xxe

Identify XML External Entity vulnerabilities in web applications via XML parsing and file inclusion attacks.

Community
Advanced
jinyimeng01jinyimeng01
54

exploit-agent

Validate suspected web vulnerabilities and generate structured exploit reports.

Community
Advanced
dungsnowaxedungsnowaxe

xxe-testing

Detect XXE injection vulnerabilities by injecting malicious XML payloads into endpoints.

Community
Advanced
marcboggsmarcboggs

hunt-xxe

Detect and exploit XXE vulnerabilities in XML parsers, file uploads, and SAML endpoints.

Community
Advanced