skills.rest
sayseven7
sayseven7COMMUNITY
Explore all skills by this author →
WebsiteGitHub

xslt-injection

Test XSLT injection vulnerabilities in server-side stylesheet processing.

11|4|Updated Jun 7, 2026
Search Tags:#injection#xml#processor#ssrf#stylesheet#xxe#xslt
One-click install
npx skills add https://github.com/sayseven7/frameseven --skill xslt-injection-sayseven7
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: xslt-injection
Source: https://github.com/sayseven7/frameseven/tree/main/internal/mcp/skills/xslt-injection
Command: npx skills add https://github.com/sayseven7/frameseven --skill xslt-injection-sayseven7

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps testers determine whether user-controlled XSLT or stylesheet input can be executed server-side and turned into data exposure, SSRF, file access, or code execution.

Core Features & Use Cases

  • Processor fingerprinting: Identify whether the target behaves like libxslt, Saxon, Xalan, MSXML, or another XSLT engine before choosing payloads.
  • Attack-path validation: Check reflection, document() fetches, external entities, EXSLT document writes, and platform-specific extension hooks in a controlled way.
  • Use case: When a report generator or XML-to-HTML transform accepts user input, use this Skill to confirm whether the transform layer is isolated or exploitable.

Quick Start

Use this skill to assess an authorized XSLT endpoint by fingerprinting the processor, probing harmless reflection, and validating document(), XXE, EXSLT, and extension behavior.

Frequently Asked Questions about xslt-injection

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test for XSLT injection vulnerabilities in server-side stylesheet processing?▼

To test for XSLT injection, fingerprint the target processor to identify the engine, probe for harmless reflection, and validate document(), external entities, EXSLT writes, and platform-specific extension hooks to confirm exploitability.

What is XSLT injection and when does it become exploitable in XML-to-HTML pipelines?▼

XSLT injection is a vulnerability where user-controlled stylesheet input is executed server-side. It becomes exploitable when XML-to-HTML pipelines allow document() fetches, external entities, or extension scripting, leading to data exposure or code execution.

Does XSLT processor fingerprinting work across libxslt, Saxon, Xalan, and MSXML stacks?▼

Yes, XSLT processor fingerprinting works across libxslt, Saxon, Xalan, MSXML, PHP, and .NET stacks. Identifying the specific engine first allows you to select appropriate payloads for validating extension-function and scripting behavior.

How can I validate SSRF and file access via document() in XSLT report generators?▼

You can validate SSRF and file access in XSLT report generators by probing the document() function and external entities. Confirm whether the transformation layer is isolated or if these fetches successfully reach internal network resources.

What are the limitations when testing EXSLT write primitives in SOAP handlers?▼

Testing EXSLT write primitives in SOAP handlers is limited by the specific XSLT engine's support for extension functions. Validation must confirm whether the target platform allows scripting or external writes before confirming actual impact.

Related Skills

Explore More Software Engineering Skills→
salmanabdurrahmansalmanabdurrahman

vuln-xxe

Test XML parsers for insecure external entity resolution using canary files.

Community
Advanced
dreadnodedreadnode
11

xslt-injection

Exploits XSLT processor injection vulnerabilities for authorized web application security testing.

Official
Intermediate
AcczdyAcczdy
2

testing-for-xml-injection-vulnerabilities

Test XML injection vulnerabilities via HTTP requests and generate JSON findings reports.

Community
Advanced
Prohao42Prohao42
120

xslt-injection

Identify and exploit XSLT injection vulnerabilities in web applications.

Community
Advanced