Identify and exploit XSLT processing weaknesses across engines.
npx skills add https://github.com/Yliken/ai4 --skill xslt-injection
Please help me install this Agent Skill. Skill: xslt-injection Source: https://github.com/Yliken/ai4/tree/main/skills/xslt-injection Command: npx skills add https://github.com/Yliken/ai4 --skill xslt-injection
XSLT injection testing helps security teams identify and characterize server-side transformation vulnerabilities across different processor families, enabling proactive risk mitigation.
Identify XSLT processors in scope and run targeted payloads to map capabilities.
High-intent search queries and answers about installing and using this skill.
XSLT injection testing identifies server-side transformation vulnerabilities by applying curated payloads to map processor capabilities, including XXE, document() SSRF, and EXSLT write vectors across Java, .NET, PHP, and libxslt environments.
Yes, XSLT injection testing detects XXE and document() SSRF vectors in PHP applications, validating external entity processing and out-of-band scenarios where allowed under an authorized test scope.
XSLT injection testing works with .NET and Java/Xalan environments, fingerprinting the processor family to determine applicable exploitation paths and identify potential extension surfaces for each stack.
XSLT processor fingerprinting identifies the underlying engine, such as Saxon or libxslt, to determine applicable exploitation paths, enabling targeted payload selection for mapping extension surfaces and write capabilities.
You need an authorized test scope and access to a transform endpoint to safely test XSLT injection, using a curated payload set to map capabilities across engines without exceeding authorization boundaries.
dreadnodeExploits XSLT processor injection vulnerabilities for authorized web application security testing.
Prohao42Identify and exploit XSLT injection vulnerabilities in web applications.
SnailSploitIdentify, test, and exploit XML External Entity injection vulnerabilities.
uphiagoIdentify and exploit XXE vulnerabilities across web applications and APIs.
