xxe-phantom

What problem does it solve?

This Skill provides a comprehensive methodology for detecting and exploiting XML External Entity (XXE) vulnerabilities, empowering users to identify and leverage XXE flaws in their target systems.

Core Features & Use Cases

• XXE Detection: Triggered by XML content interaction, enabling the identification of XXE vulnerabilities.
• File Read: Facilitates the reading of local files for local file disclosure and SSRF chaining.
• Blind OOB Exfiltration: Enables silent data exfiltration without direct server response.
• WAF Bypass: Offers techniques to bypass Web Application Firewalls.
• Use Case: If you suspect an XXE vulnerability in a web application, use this Skill to confirm its presence and exploit it to gain sensitive information.

Quick Start

Use the xxe-phantom skill to trigger an XXE on the target server by sending a request with the following XML payload to the endpoint /api/xml:

<?xml version="1.0"?>
<!DOCTYPE root [
  <!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<root><data>&xxe;</data></root>