skills.rest
bingook
bingookCOMMUNITY
Explore all skills by this author →
GitHub

xxe-xml-external-entity

Detect and exploit XML External Entity vulnerabilities in XML-based systems.

Updated Aug 23, 2026
Search Tags:#security#vulnerability#exploitation#xml#xxe#xml external entity
One-click install
npx skills add https://github.com/bingook/bingo --skill xxe-xml-external-entity-bingook
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: xxe-xml-external-entity
Source: https://github.com/bingook/bingo/tree/main/bingo/skills/hack-skills/xxe-xml-external-entity
Command: npx skills add https://github.com/bingook/bingo --skill xxe-xml-external-entity-bingook

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill provides an expert-level XML External Entity Injection (XXE) playbook for security testing, enabling the detection and exploitation of XXE vulnerabilities in various contexts.

Core Features & Use Cases

  • XXE Detection and Exploitation: Identifies and leverages XXE vulnerabilities in XML-based systems and services.
  • Attack Surface Discovery: Discovers XML input points in web applications, including SOAP, REST, file uploads, and more.
  • OOB Exfiltration: Implements out-of-band XXE attacks for data exfiltration when direct entity reflection fails.
  • File Read Targets: Specifies file read targets on both Linux and Windows systems for XXE attacks.
  • SVG and Office File XXE: Exploits XXE vulnerabilities in SVG and Office files (docx/xlsx/pptx).
  • SOAP Endpoint XXE: Demonstrates XXE attacks on SOAP endpoints.
  • XXE to SSRF Chain: Combines XXE with SSRF for internal service pivoting.
  • XInclude Attack: Exploits XInclude in XML processing for XXE attacks.
  • Protocol Handlers in XXE: Demonstrates XXE attacks using various protocols like HTTP, FTP, Gopher, etc.
  • Bypassing Defenses: Provides techniques to bypass common XXE defenses.
  • Quick Detection Checklist: Offers a checklist for quick XXE detection.
  • Local DTD Injection: Amplifies blind XXE attacks using local DTD files.
  • Additional OOB Exfiltration Channels: Implements alternative OOB exfiltration methods.
  • DTD Nesting Tricks: Demonstrates parameter entity chaining for XXE attacks.
  • XXE in Non-Obvious Formats: Exploits XXE in various non-XML formats like SOAP, SVG, Office files, etc.
  • XXE via File Upload: Exploits XXE vulnerabilities in file upload contexts.
  • Error-Based XXE: Uses error messages to leak data in XXE attacks.
  • XSLT Injection Connection to XXE: Combines XXE with XSLT for file read and RCE attacks.

Quick Start

Use the xxe-xml-external-entity skill to perform a blind XXE attack on the target system 'example.com'.

Frequently Asked Questions about xxe-xml-external-entity

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I perform a blind XXE attack when there is no direct entity reflection?▼

Blind XXE attacks use out-of-band (OOB) exfiltration to extract data when direct reflection fails. This Skill implements OOB channels and local DTD injection to amplify blind attacks using error messages or alternative data retrieval methods.

What is the best way to exploit XXE vulnerabilities in file upload features?▼

Exploiting XXE in file uploads targets non-XML formats like SVG and Office files (docx/xlsx/pptx). This Skill identifies XML input points in these formats to execute file read, SSRF, and RCE attacks via malicious entity definitions.

Can I chain XXE with SSRF for internal service pivoting?▼

Yes, XXE can be combined with SSRF for internal service pivoting. This Skill demonstrates chaining XML External Entity attacks using various protocol handlers like HTTP, FTP, and Gopher to interact with internal services.

How do I bypass common XML parser defenses during XXE testing?▼

Bypassing XXE defenses involves using techniques like XInclude attacks and parameter entity chaining. This Skill provides methods to evade standard XML parsing restrictions and exploit processing vulnerabilities in non-obvious formats.

Does this Skill support error-based XXE data exfiltration?▼

Yes, error-based XXE is supported. This Skill leverages XML parsing error messages to leak sensitive file contents and system data when out-of-band exfiltration channels are unavailable or blocked.

What prerequisite knowledge is needed to detect and exploit XML External Entity vulnerabilities?▼

Detecting and exploiting XXE requires knowledge of XML parsing, DTDs, and various attack vectors. This Skill serves as an expert playbook, assuming familiarity with XML input points in SOAP, REST, and other web application formats.

Related Skills

Explore More Software Engineering Skills→
ricardoo022ricardoo022

scan-fase-1

Identify configurations, secrets, and attack-surface exposure from JS-bundled web applications.

Community
Advanced
woohyun212woohyun212
21

web-vuln-ssrf

Detects SSRF vulnerabilities in web applications using OOB callbacks and metadata probes.

Community
Advanced
YukiIto1999YukiIto1999

performing-blind-ssrf-exploitation

Identify and exploit blind SSRF vulnerabilities using out-of-band callbacks and timing analysis.

Community
Advanced
ArianHobson333ArianHobson333
7

xxe

Detect XML External Entity flaws in Java, Python, and .NET XML parsers.

Community
Advanced