Identify, test, and exploit XML External Entity injection vulnerabilities.
npx skills add https://github.com/SnailSploit/Claude-Red --skill xxe-snailsploit
Please help me install this Agent Skill. Skill: xxe Source: https://github.com/SnailSploit/Claude-Red/tree/main/Skills/offensive-xxe Command: npx skills add https://github.com/SnailSploit/Claude-Red --skill xxe-snailsploit
This Skill helps identify and exploit XML External Entity (XXE) vulnerabilities, a common security flaw that can lead to data disclosure, server-side request forgery, and even remote code execution.
Use the xxe skill to test for XXE vulnerabilities by attempting to read the '/etc/passwd' file.
High-intent search queries and answers about installing and using this skill.
To test for XML External Entity (XXE) injection, you can systematically probe XML parsers by injecting malicious payloads to read local files like '/etc/passwd' or attempt server-side request forgery. This methodology covers detection, exploitation, and chaining techniques.
Blind XXE occurs when an application does not return responses from injected XML entities in the HTTP response. Out-of-band data exfiltration resolves this by forcing the parser to send sensitive data to an attacker-controlled external server, allowing you to extract files without direct output.
Yes, XML injection can be exploited through file uploads like SVG and DOCX files. These formats contain embedded XML structures that vulnerable parsers will process, allowing you to inject external entities and exfiltrate data or trigger server-side requests upon upload.
You can chain XXE vulnerabilities to perform SSRF attacks by defining external entities that point to internal network URLs or cloud metadata endpoints. When the XML parser resolves these entities, it issues server-side requests, exposing internal resources.
Yes, there are specific bypass techniques to evade XML injection filters, such as encoding payloads or using parameter entities. For remediation, the recommended approach is to disable external entity resolution and DTD processing in your XML parser configuration.
securityfortechDetect and exploit XXE injection vulnerabilities in XML processing applications.
yaklangIdentify and exploit XML external entity vulnerabilities to read local files.
cybersecwomanDetect and exploit SSRF vulnerabilities in web applications.
zebbernAutomate red-team reconnaissance and vulnerability discovery workflows.
