skills.rest
EntroVyx
EntroVyxCOMMUNITY
Explore all skills by this author →
GitHub

hunt-xxe

Map XML entry points and test for in-band or blind OOB data exfiltration.

3|1|Updated Jul 2, 2026
Search Tags:#security#vulnerability#xml#pentesting#ssrf#xxe
One-click install
npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill hunt-xxe-entrovyx
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-xxe
Source: https://github.com/EntroVyx/hermes-agent-offsec/tree/main/skills/offsec/redteam/hunt-xxe
Command: npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill hunt-xxe-entrovyx

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill addresses the difficulty of identifying and exploiting XML External Entity (XXE) vulnerabilities across complex, multi-layered application architectures, including blind OOB scenarios.

Core Features & Use Cases

  • Comprehensive Hunting: Provides a systematic methodology for identifying XML entry points, including file uploads and API endpoints.
  • Exploitation Chains: Facilitates the creation of impact-driven chains, such as XXE-to-SSRF, XXE-to-LFI, and XXE-to-RCE.
  • Blind OOB Validation: Includes specific workflows for confirming blind XXE via DNS/HTTP callbacks, ensuring high-confidence reporting.

Quick Start

Use the hunt-xxe skill to scan the target endpoint for XML parsing vulnerabilities and validate potential OOB exfiltration paths.

Frequently Asked Questions about hunt-xxe

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I identify XML External Entity vulnerabilities in web applications?▼

To identify XML External Entity (XXE) vulnerabilities, systematically map XML entry points like file uploads and API endpoints, then test XML parsers for entity expansion and network egress capabilities.

What is the best way to test for blind XXE using out-of-band exfiltration?▼

The best way to test for blind XXE is using out-of-band (OOB) data exfiltration via DNS and HTTP callbacks, which confirms high-confidence vulnerabilities when in-band responses are unavailable.

Can I use XXE exploitation to achieve SSRF or local file inclusion?▼

Yes, you can use XXE exploitation to achieve Server-Side Request Forgery (SSRF) and local file inclusion (LFI), creating impact-driven security chains by abusing XML parser network egress capabilities.

Does XML parser testing work for API gateways and file processing services?▼

XML parser testing works for API gateways and file processing services that handle XML-based content types, mapping entry points and testing for entity expansion to demonstrate security impact.

When do I need to test XML entry points for entity expansion vulnerabilities?▼

You need to test XML entry points for entity expansion vulnerabilities when web applications or API gateways process XML-based content types, ensuring systematic validation of parser network egress capabilities.

How to validate blind XXE vulnerabilities without in-band responses?▼

To validate blind XXE vulnerabilities without in-band responses, use out-of-band (OOB) data exfiltration workflows relying on DNS or HTTP callbacks to confirm high-confidence security findings.

Related Skills

Explore More Software Engineering Skills→
ricardoo022ricardoo022

scan-fase-1

Identify configurations, secrets, and attack-surface exposure from JS-bundled web applications.

Community
Advanced
yhy0yhy0
74

pentest-deserialization-xxe

Identify and exploit deserialization and XXE vulnerabilities in web applications.

Community
Advanced
enderphan94enderphan94
1

stress-scan

Orchestrate vulnerability agents to assess web surfaces and verify findings via HTTP and OOB channels.

Community
Advanced
grivera82grivera82

hunt-xxe

Detect and exploit XML parser XXE vulnerabilities for file reads and OOB callbacks.

Community
Advanced