xxe

Identify, test, and exploit XML External Entity injection vulnerabilities.

2.9k|469|Updated Mar 4, 2026

Search Tags:#vulnerability #security testing #data exfiltration #ssrf #xxe #xml injection

Ready to run

npx skills add https://github.com/SnailSploit/Claude-Red --skill xxe-snailsploit

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: xxe
Source: https://github.com/SnailSploit/Claude-Red/tree/main/Skills/offensive-xxe
Command: npx skills add https://github.com/SnailSploit/Claude-Red --skill xxe-snailsploit

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill helps identify and exploit XML External Entity (XXE) vulnerabilities, a common security flaw that can lead to data disclosure, server-side request forgery, and even remote code execution.

Core Features & Use Cases

XXE Detection: Identifies potential XXE injection points in XML parsers.
Exploitation Techniques: Provides methods for classic XXE, blind XXE (out-of-band), and XXE via file uploads (SVG, DOCX).
Use Case: When testing a web application that accepts XML input, use this Skill to systematically probe for and exploit XXE vulnerabilities to access sensitive files or internal network resources.

Quick Start

Use the xxe skill to test for XXE vulnerabilities by attempting to read the '/etc/passwd' file.

Frequently Asked Questions about xxe

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I test for XML External Entity injection vulnerabilities in web applications?▼

To test for XML External Entity (XXE) injection, you can systematically probe XML parsers by injecting malicious payloads to read local files like '/etc/passwd' or attempt server-side request forgery. This methodology covers detection, exploitation, and chaining techniques.

What is blind XXE and how does out-of-band data exfiltration work?▼

Blind XXE occurs when an application does not return responses from injected XML entities in the HTTP response. Out-of-band data exfiltration resolves this by forcing the parser to send sensitive data to an attacker-controlled external server, allowing you to extract files without direct output.

Can XML injection be exploited through file uploads like SVG or DOCX?▼

Yes, XML injection can be exploited through file uploads like SVG and DOCX files. These formats contain embedded XML structures that vulnerable parsers will process, allowing you to inject external entities and exfiltrate data or trigger server-side requests upon upload.

How can I chain XXE vulnerabilities to perform SSRF attacks?▼

You can chain XXE vulnerabilities to perform SSRF attacks by defining external entities that point to internal network URLs or cloud metadata endpoints. When the XML parser resolves these entities, it issues server-side requests, exposing internal resources.

Are there bypass techniques for XML injection filters and what remediation is recommended?▼

Yes, there are specific bypass techniques to evade XML injection filters, such as encoding payloads or using parameter entities. For remediation, the recommended approach is to disable external entity resolution and DTD processing in your XML parser configuration.