xxe

What problem does it solve?

This Skill helps penetration testers identify and exploit XML External Entity (XXE) injection vulnerabilities in web applications, allowing for file disclosure, server-side request forgery, and potential remote code execution.

Core Features & Use Cases

• XXE Detection: Probes for XXE vulnerabilities by testing entity resolution.
• File Disclosure: Reads sensitive files from the server (e.g., /etc/passwd).
• SSRF: Leverages XXE to make requests to internal or external resources.
• Blind XXE: Handles scenarios where responses are not reflected, using out-of-band techniques.
• File Upload Exploitation: Exploits XXE in file upload formats like SVG, DOCX, and XLSX.

Quick Start

Use the xxe skill to attempt reading the '/etc/passwd' file from the target.