xxe-xml-external-entity

Identify and exploit XML external entity vulnerabilities to read local files.

1.6k|204|Updated Apr 7, 2026

Search Tags:#vulnerability #xml #ssrf #security-testing #xxe #external-entity #office-xml

Ready to run

npx skills add https://github.com/yaklang/hack-skills --skill xxe-xml-external-entity

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: xxe-xml-external-entity
Source: https://github.com/yaklang/hack-skills/tree/main/skills/xxe-xml-external-entity
Command: npx skills add https://github.com/yaklang/hack-skills --skill xxe-xml-external-entity

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

XXE vulnerabilities allow an attacker to read local files, perform SSRF, and exfiltrate data through XML parsers across diverse formats such as XML, SVG, OOXML, and SOAP. This playbook provides structured tactics for detection, exploitation, and mitigation, enabling secure testing and effective remediation planning.

Core Features & Use Cases

Cross-format XXE payloads for XML, SVG, OOXML (docx/xlsx/pptx), SOAP, and JSON→XML transformations.
OOB and blind XXE techniques including collaborator-based exfiltration and error-based leakage, plus SSRF chaining.
Defensive guidance with configuration hardening, parser safeguards, and validation strategies for reducing XXE risk in production.

Quick Start

Identify an XML input point (SOAP, SVG, OOXML, or parser-driven import) and apply the classic and blind XXE payloads to verify vulnerability.

Frequently Asked Questions about xxe-xml-external-entity

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I exploit XXE vulnerabilities to read local files via XML parsing?▼

XXE exploitation injects external entity definitions into XML inputs to read local files and exfiltrate data. This skill provides structured payloads for XML, SOAP, SVG, and OOXML formats to test parser configurations and verify vulnerable file retrieval.

Can I use XXE payloads to perform SSRF attacks through XML parsers?▼

XXE can be chained to perform SSRF by defining external entities that target internal URLs. This skill includes out-of-band and blind XXE techniques, enabling collaborator-based data exfiltration and internal network interaction through vulnerable XML parsers.

What's the best way to test for blind XXE when the parser returns no output?▼

Blind XXE testing uses out-of-band data exfiltration and error-based leakage when parsers return no direct output. This playbook documents collaborator-based techniques and error message analysis to detect and confirm blind XXE vulnerabilities across XML formats.

Does this cover XXE testing for OOXML formats like docx and xlsx?▼

Yes, this skill covers OOXML formats including docx, xlsx, and pptx. It provides cross-format XXE payloads specifically designed for Office XML structures, allowing you to test parser-driven imports and identify external entity vulnerabilities in document files.

How do I harden XML parser configurations to prevent XXE attacks?▼

To prevent XXE, you must harden XML parser configurations by disabling external entity resolution and DTD processing. This skill provides defensive guidance, validation strategies, and specific parser safeguards to reduce XXE risk in production environments.

Why does my SVG file upload trigger an XXE vulnerability?▼

SVG files are XML-based and often parsed with external entity resolution enabled, making them a vector for XXE attacks. This skill details SVG XML exploitation payloads to help you understand the parsing mechanism and verify the vulnerability.