skills.rest
inventashif
inventashifCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

hunt-xxe

Detects and exploits XXE vulnerabilities in XML parsers, file uploads, and SAML endpoints.

Updated Sep 6, 2026
Search Tags:#penetration testing#file upload#ssrf#bug bounty#xxe#xml injection#oob exfiltration
One-click install
npx skills add https://github.com/inventashif/helpful-code-sidekick --skill hunt-xxe-inventashif
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-xxe
Source: https://github.com/inventashif/helpful-code-sidekick/tree/main/scripts/hackerai/skills/bughunter/hunt-xxe
Command: npx skills add https://github.com/inventashif/helpful-code-sidekick --skill hunt-xxe-inventashif

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Finding XML External Entity (XXE) vulnerabilities requires knowing which endpoints parse XML, which parser defaults are exploitable, and how to confirm blind cases with out-of-band callbacks. This Skill provides a structured hunting methodology built from 10 real bug bounty reports so testers can systematically identify, validate, and document XXE findings. ## Core Features & Use Cases - Attack Surface Mapping: Identifies XML entry points via URL patterns, Content-Type headers, JavaScript parsing calls, and tech-stack fingerprints across Java, PHP, Python, Ruby, and .NET stacks. - Payload Library: Provides ready-to-use payloads for in-band file reads, blind OOB exfiltration via parameter entities, SVG/DOCX upload XXE, SSRF pivots to AWS metadata, and WAF/filter bypasses. - Validation Gates: Enforces an OOB-Or-It-Didn't-Happen standard for blind cases and a Gate 0 impact checklist before report submission. - Use Case: While testing a target's file upload feature, upload a crafted SVG containing an external entity, confirm a Burp Collaborator callback, then escalate to exfiltrate /etc/passwd via a two-stage DTD payload and document the full impact chain. ## Quick Start Use the hunt-xxe skill to test this target's XML endpoints and file upload features for XXE vulnerabilities, starting with an inline entity probe and escalating to blind OOB confirmation.

Frequently Asked Questions about hunt-xxe

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test for XXE vulnerabilities in a web application?▼

Start by mapping XML entry points with Burp Suite, then send an inline entity probe like <!ENTITY hello "world"> to check if the parser expands entities. If it does, escalate to SYSTEM file reads of /etc/passwd or win.ini, and use blind OOB callbacks when no reflection occurs.

How to exploit blind XXE with out-of-band exfiltration?▼

Blind XXE requires a two-stage parameter entity attack: host an evil DTD on your server that reads a local file and sends its contents to your listener via HTTP or DNS. Confirm the initial callback with Burp Collaborator or interactsh before attempting data exfiltration.

Which XML parsers are vulnerable to XXE by default?▼

Java SAX/DOM without hardening, PHP DOMDocument with LIBXML_NOENT, older .NET XmlDocument configurations, and legacy Struts remain vulnerable by default. Modern Python xml.etree, lxml 5+, and default Ruby Nokogiri are safe, so fingerprint the stack before investing time.

Can XXE be exploited through SVG or DOCX file uploads?▼

Yes, SVG files are XML and Office formats like DOCX and PPTX are ZIP archives of XML parts. Inject a DOCTYPE with an external entity into the SVG root or into files like word/document.xml, and the server-side parser may resolve it during rendering or conversion.

Why does my XXE payload fail even though the endpoint accepts XML?▼

The parser likely has external entities disabled, which is the modern default in Python, Ruby, and .NET 4.5.2+. Confirm with an inline entity probe first; if a simple internal entity does not expand, SYSTEM file reads will not work either and you should pivot to other bug classes.

What impact is needed for a valid XXE bug bounty report?▼

You must demonstrate actual data exposure such as /etc/passwd contents, AWS metadata credentials, or internal service access via SSRF. A lone DNS callback proves only that the parser fetches entities and typically rates Low to Medium rather than Critical severity.

Related Skills

Explore More Software Engineering Skills→
jokken79jokken79
1

Burp Suite Web Application Testing

Intercept, modify, and analyze HTTP traffic to identify web application vulnerabilities.

Community
Advanced
kaminocorpkaminocorp
1

Vulnerability Report Writing

Generate bounty-ready vulnerability reports with CVSS scoring and evidence-based severity calibration.

Official
Intermediate
wgpsecwgpsec
1.6k

cloud-metadata

Detect and exploit cloud instance metadata across AWS, Azure, GCP, Alibaba Cloud, and Tencent Cloud.

Official
Advanced
securityfortechsecurityfortech
6

xxe

Detect and exploit XXE injection vulnerabilities in XML processing applications.

Official
Advanced