Detect and exploit XML parser XXE vulnerabilities for file reads and OOB callbacks.
npx skills add https://github.com/grivera82/pi-bughunter --skill hunt-xxe-grivera82
Please help me install this Agent Skill. Skill: hunt-xxe Source: https://github.com/grivera82/pi-bughunter/tree/main/skills/hunt-xxe Command: npx skills add https://github.com/grivera82/pi-bughunter --skill hunt-xxe-grivera82
XML-based applications frequently expose serious vulnerabilities when XML parsers resolve external entities. This skill bundles known XXE techniques and practical steps to reliably identify exploitable configurations and potential data exposure.
Perform a targeted XXE assessment against an XML-processing endpoint to verify if entity expansion occurs and whether it yields a local file read or an OOB callback.
High-intent search queries and answers about installing and using this skill.
Testing for XXE vulnerabilities involves injecting external entity payloads into XML endpoints to verify parser resolution, enabling local file reads or blind out-of-band callbacks across SOAP, REST, and OOXML formats.
An XML external entity attack exploits XML parsers that resolve external entities, allowing attackers to read local files, trigger SSRF, or exfiltrate data via blind OOB callbacks across web services and APIs ingesting XML.
Yes, XXE payloads apply across Java, PHP, .NET, and Python stacks, with a catalog of techniques for file read, SSRF, and blind OOB scenarios tailored to these common application environments.
The best way to find blind XXE in APIs is using structured hunting playbooks that guide endpoint discovery and payload selection, triggering out-of-band callbacks to confirm entity resolution without direct server responses.
To bypass hardened XML parsers, the skill includes fallback techniques for hardened configurations, applying alternative entity expansion probes to verify if parser hardening is fully effective or partially exploitable.
To collect evidence for an XXE report, follow structured hunting playbooks to capture reproducible results from inline probes and OOB callbacks, documenting file reads and SSRF triggers for controlled testing.
sseshachalaIdentify XXE vulnerabilities in XML parsers via inline and DTD payloads.
chatbotkitIdentify and validate XXE vulnerabilities in XML parsers with inline ENTITY and OOB tests.
Q16GDetect and validate external XML entity vulnerabilities in authorized targets.
pdparchitectDetect and validate XML External Entity vulnerabilities in web applications and API gateways.
