Identify and validate XXE vulnerabilities in XML parsers with inline ENTITY and OOB tests.
npx skills add https://github.com/chatbotkit/rook --skill hunt-xxe-chatbotkit
Please help me install this Agent Skill. Skill: hunt-xxe Source: https://github.com/chatbotkit/rook/tree/main/skills/hunt-xxe Command: npx skills add https://github.com/chatbotkit/rook --skill hunt-xxe-chatbotkit
This Skill helps security researchers identify and validate XXE vulnerabilities across XML parsers and related processing surfaces, reducing risk of data exposure and server compromise.
Submit a crafted XML payload to an XML processing endpoint and observe for local file reads or OOB callbacks.
High-intent search queries and answers about installing and using this skill.
To test for XXE vulnerabilities in XML parsers, submit crafted inline ENTITY payloads to endpoints and observe for local file reads or out-of-band network callbacks to confirm data exposure.
An out-of-band callback in XXE hunting is an external network interaction triggered by a payload, providing clear evidence that the XML parser attempted to resolve a malicious external entity, confirming the vulnerability.
To validate XXE vulnerabilities in file-upload features, inject XML payloads into supported document processing pipelines and check for server compromise or file contents exposure through structured hunting workflows.
Yes, you can pivot from XXE to SSRF or RCE in vulnerable stacks using structured hunting workflows that leverage external entity resolution to interact with internal services or execute remote code.
Yes, this XXE hunting workflow generates reproducible test payloads and validation steps along with impact evidence like file contents, directly supporting incident response and bug bounty reporting requirements.
It takes under 10 minutes to verify an XML parser vulnerability by applying specified parser hints and required conditions to reproduce the test payload and collect evidence of impact.
sseshachalaIdentify XXE vulnerabilities in XML parsers via inline and DTD payloads.
mlvpatelValidate bug bounty submissions against a 7-question gate and four pre-submission checks.
erhankaraarslanAnalyze a codebase to reveal architecture, data flow, and entry points.
RifteoDetect and exploit XML External Entity vulnerabilities in web applications.
