Guide XXE injection exploitation for file disclosure, SSRF, and RCE.
npx skills add https://github.com/blacklanternsecurity/red-run --skill xxe
Please help me install this Agent Skill. Skill: xxe Source: https://github.com/blacklanternsecurity/red-run/tree/main/skills/web/xxe Command: npx skills add https://github.com/blacklanternsecurity/red-run --skill xxe
This Skill helps penetration testers identify and exploit XML External Entity (XXE) injection vulnerabilities in web applications, allowing for file disclosure, server-side request forgery, and potential remote code execution.
/etc/passwd).Use the xxe skill to attempt reading the '/etc/passwd' file from the target.
High-intent search queries and answers about installing and using this skill.
To exploit XXE injection vulnerabilities, you identify XML parser surfaces and test entity resolution to read files, perform SSRF, or achieve RCE. Techniques include classic, blind, error-based, and XInclude approaches depending on parser reflection capabilities.
Blind XXE occurs when application responses do not reflect parsed XML entity data. Exploitation uses out-of-band techniques to exfiltrate files or perform SSRF by forcing the parser to make external requests to attacker-controlled endpoints.
Yes, XXE exploitation is possible via file uploads using formats like SVG, DOCX, and XLSX. These file types contain XML structures that parsers process, allowing injection of malicious external entities to trigger file disclosure or SSRF.
WAF bypass methods for XML injection involve modifying payload encodings, using XInclude techniques, or leveraging file upload formats like SVG and DOCX. These approaches obscure malicious entity definitions while maintaining parser execution.
Classic XXE reflects parsed entity data directly in responses, blind XXE requires out-of-band exfiltration without reflection, and error-based XXE extracts data through parser error messages. Choice depends on application response behavior.
salmanabdurrahmanValidate WebSocket origin verification, authentication, and channel authorization controls.
wgpsecDetect and exploit cloud instance metadata across AWS, Azure, GCP, Alibaba Cloud, and Tencent Cloud.
ok-helloworldDetect and exploit XXE vulnerabilities for file disclosure and blind OOB exfiltration.
vitoropereiraDetect stored, reflected, and DOM-based XSS and HTML injection vulnerabilities in web applications.