Identify and exploit XXE vulnerabilities across web applications and APIs.
npx skills add https://github.com/uphiago/recon-skills --skill hunt-xxe-uphiago
Please help me install this Agent Skill. Skill: hunt-xxe Source: https://github.com/uphiago/recon-skills/tree/main/redteam/hunt-xxe Command: npx skills add https://github.com/uphiago/recon-skills --skill hunt-xxe-uphiago
XXE is a high-severity vulnerability that enables file read, SSRF, and RCE but is often missed during standard security assessments due to non-primary XML content types and hidden XML parsing in file uploads and SAML integrations. This Skill provides a complete, field-validated hunting framework to identify and exploit XXE flaws across modern tech stacks.
Use the hunt-xxe skill to test all XML-ingesting endpoints and file upload features on the authorized target for XXE vulnerabilities, including blind out-of-band and SSRF pivot chains.
High-intent search queries and answers about installing and using this skill.
To test for XXE vulnerabilities, map XML entry points across APIs and file uploads, then inject payloads for in-band file read, blind out-of-band exfiltration, and SSRF pivots to validate exploitable flaws.
Blind XXE attacks use out-of-band exfiltration vectors by injecting external entity payloads that force the XML parser to make external network requests, enabling data theft and SSRF pivots without direct server responses.
Bypass WAF and content-type validation during XML External Entity exploitation by applying a pre-built bypass library designed to evade hardened parsers, egress filters, and strict input validation mechanisms.
Yes, this XXE testing framework supports SAML SSO and Office document parsers by fingerprinting the parser ecosystem to identify hidden XML processing and target high-value integrations effectively.
The best way to find hidden XML parsing vulnerabilities in JSON APIs is to comprehensively map the attack surface, testing endpoints for underlying XML conversion flaws using specialized payloads.
Standard security assessments miss XML External Entity flaws in file upload features because they often overlook non-primary XML content types and hidden parsing in formats like SVG, DOCX, and XLSX files.
dakshrawat298-gifMap application entry points and input pathways to model the attack surface.
EntroVyxIdentify and exploit file upload vulnerabilities including RCE, SSRF, and XSS.
SnailSploitIdentify, test, and exploit XML External Entity injection vulnerabilities.
vitoropereiraDetect stored, reflected, and DOM-based XSS and HTML injection vulnerabilities in web applications.
