Test XML parsers for insecure external entity resolution using canary files.
npx skills add https://github.com/salmanabdurrahman/pi-pentest-agent --skill vuln-xxe
Please help me install this Agent Skill. Skill: vuln-xxe Source: https://github.com/salmanabdurrahman/pi-pentest-agent/tree/main/skills/vuln-xxe Command: npx skills add https://github.com/salmanabdurrahman/pi-pentest-agent --skill vuln-xxe
This skill provides a structured, safe, and authorized methodology for identifying XML external entity (XXE) injection vulnerabilities in web applications without risking data exposure or system instability.
Use the vuln-xxe skill to perform a safe canary file read test on the target XML endpoint identified in your scope.
High-intent search queries and answers about installing and using this skill.
XML external entity (XXE) injection testing can be performed safely by using non-sensitive canary files like /etc/hostname to confirm parser vulnerabilities without accessing sensitive system data. This approach prevents data exposure while validating insecure entity resolution.
Blind XXE detection identifies vulnerabilities where no direct output is returned by using out-of-band (OOB) monitoring via DNS and HTTP callbacks. This technique confirms insecure XML entity resolution by observing external network interactions triggered by the parser.
You validate XML external entity vulnerabilities in SOAP APIs and SAML endpoints by testing XML parsers for insecure entity resolution. This involves applying structured injection techniques to the XML-processing endpoints identified in your security assessment scope.
XML external entity injection testing uses multiple vectors including classic file-read, XInclude, and SVG-based injection techniques. These methods test XML parsers for insecure entity resolution across different XML-based formats processed by the target application.
Yes, you can use canary file reads to confirm XML parser vulnerabilities safely. By targeting non-sensitive files like /etc/hostname, you can verify insecure entity resolution and validate XML external entity vulnerabilities without risking system instability or data exposure.
roderikAnalyze API surfaces and configuration schemas to detect misuse-prone designs.
pdparchitectDetect and validate XML External Entity vulnerabilities in web applications and API gateways.
cybersecwomanIdentify XML External Entity vulnerabilities in web applications via XML parsing and file inclusion attacks.
cmndcntrlcyberDetect SAML and SSO vulnerabilities including XML Signature Wrapping and XXE.
