xxe-xml-external-entity

XXE exploitation injects external entity definitions into XML inputs to read local files and exfiltrate data. This skill provides structured payloads for XML, SOAP, SVG, and OOXML formats to test parser configurations and verify vulnerable file retrieval.

XXE can be chained to perform SSRF by defining external entities that target internal URLs. This skill includes out-of-band and blind XXE techniques, enabling collaborator-based data exfiltration and internal network interaction through vulnerable XML parsers.

Blind XXE testing uses out-of-band data exfiltration and error-based leakage when parsers return no direct output. This playbook documents collaborator-based techniques and error message analysis to detect and confirm blind XXE vulnerabilities across XML formats.

Yes, this skill covers OOXML formats including docx, xlsx, and pptx. It provides cross-format XXE payloads specifically designed for Office XML structures, allowing you to test parser-driven imports and identify external entity vulnerabilities in document files.

To prevent XXE, you must harden XML parser configurations by disabling external entity resolution and DTD processing. This skill provides defensive guidance, validation strategies, and specific parser safeguards to reduce XXE risk in production environments.

SVG files are XML-based and often parsed with external entity resolution enabled, making them a vector for XXE attacks. This skill details SVG XML exploitation payloads to help you understand the parsing mechanism and verify the vulnerability.