skills.rest
brucesongs
brucesongsCOMMUNITY
Explore all skills by this author →
GitHub

web-xxe

Identify and exploit XML External Entity vulnerabilities in XML-processing endpoints.

60|14|Updated Apr 27, 2026
Search Tags:#xml#payloads#ssrf#security-testing#xxe#oob-exfiltration
One-click install
npx skills add https://github.com/brucesongs/kali-claw --skill web-xxe
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: web-xxe
Source: https://github.com/brucesongs/kali-claw/tree/main/skills/web-xxe
Command: npx skills add https://github.com/brucesongs/kali-claw --skill web-xxe

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

XML External Entity (XXE) injection vulnerabilities allow attackers to read local files, reach internal services, exfiltrate data, and cause denial of service when XML parsers resolve entities. This Skill equips security testers with structured payloads, tooling guidance, and methodology to identify, validate, and chain XXE vectors across web apps and document processing pipelines.

Core Features & Use Cases

  • Attack coverage: classic XXE file disclosure, blind XXE via OOB channels, error-based XXE, XXE to SSRF, parameter entity exploitation, and OOXML/XHTML vectors.
  • World-wide applicability: SOAP/REST XML endpoints, XML-based file processing (SVG, OOXML documents), and cloud/internal services; supports multiple egress channels (HTTP, DNS, FTP) for exfiltration.
  • Use Case: A security tester validates an XML-processing endpoint, identifies an in-band disclosure, and then pivots to OOB exfiltration to demonstrate impact and remediation needs.

Quick Start

Identify XML-processing endpoints (SOAP/REST with XML, XML file uploads) and test with a minimal XXE payload to confirm external entity resolution.

Frequently Asked Questions about web-xxe

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect and exploit XXE vulnerabilities in XML processing endpoints?▼

To detect XXE vulnerabilities, inject a minimal XML payload with an external entity into SOAP or REST endpoints to confirm if the parser resolves it. Exploitation involves using structured payloads for in-band file disclosure or OOB exfiltration channels.

Can I use XXE payloads to target document file uploads like SVG or DOCX?▼

Yes, XXE payloads can target XML-based file processors including SVG, DOCX, and XLSX formats. These OOXML and XHTML vectors allow external entity injection when the application parses the embedded XML structure of uploaded documents.

How do I perform SSRF attacks using XML External Entity injection?▼

XXE to SSRF attacks use parameter entity exploitation to force the XML parser to make server-side requests to internal or cloud services. This allows reaching restricted network endpoints by resolving external entity URIs.

Which tools are recommended for automating XML External Entity injection testing?▼

Recommended tools for XXE testing include XXEinjector, oxml_xxe, xxeplus, and Burp Suite. These tools assist with payload automation, OOB exfiltration setup, and intercepting XML requests across different testing scenarios.

Related Skills

Explore More Software Engineering Skills→
AcczdyAcczdy
2

performing-soap-web-service-security-testing

Analyze SOAP WSDLs and test endpoints for XML injection and WS-Security weaknesses.

Community
Intermediate
wgpsecwgpsec
1.6k

internal-recon

Map live hosts, open ports, services, and critical assets in internal networks using fscan.

Official
Intermediate
jcastillotxjcastillotx

Burp Suite Web Application Testing

Intercept and analyze HTTP traffic with Burp Suite proxy tools.

Community
Advanced
vitoropereiravitoropereira

Cross-Site Scripting and HTML Injection Testing

Detect stored, reflected, and DOM-based XSS and HTML injection vulnerabilities in web applications.

Community
Advanced