skills.rest
ok-helloworld
ok-helloworldCOMMUNITY
Explore all skills by this author →
GitHub

xxe-xml-external-entity

Detect and exploit XXE vulnerabilities for file disclosure and blind OOB exfiltration.

241|28|Updated May 20, 2026
Search Tags:#ooxml#soap#xxe#xml parsing#oob exfiltration#svg uploads#ssrf chain
One-click install
npx skills add https://github.com/ok-helloworld/vibe-pentest --skill xxe-xml-external-entity-ok-helloworld
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: xxe-xml-external-entity
Source: https://github.com/ok-helloworld/vibe-pentest/tree/main/references/pentest_skills/xxe-xml-external-entity
Command: npx skills add https://github.com/ok-helloworld/vibe-pentest --skill xxe-xml-external-entity-ok-helloworld

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill helps you detect and exploit XML External Entity (XXE) weaknesses to perform file reads and blind out-of-band exfiltration when responses do not reflect entity output.

Core Features & Use Cases

  • XXE payload crafting and injection: Covers classic DOCTYPE/entity payloads and multiple XML contexts (SOAP, REST XML, RSS/Atom, SVG, and XML-driven imports).
  • Blind and OOB verification: Uses collaborator/HTTP/DNS callbacks and error-based techniques to confirm XXE without direct reflection.
  • Real-world escalation chains: Includes XXE→SSRF chaining and documented CVE-style scenarios such as Apache Solr XXE+RCE and Office OOXML XXE step-by-step.
  • Defense-aware bypasses: Provides alternatives when DOCTYPE/entity reflection is blocked, including XInclude and local DTD amplification.
  • Upload/processing pipelines: Focuses on triggering XXE via server-side parsing of uploaded Office documents and SVG.

Quick Start

Send the target URL and an example request where the app accepts or processes XML (or where you can upload an Office/SVG file) and ask the AI to verify XXE using an OOB blind test, then escalate to file read or XXE→SSRF if confirmation is achieved.

Frequently Asked Questions about xxe-xml-external-entity

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I exploit XXE vulnerabilities for blind out-of-band data exfiltration?▼

Exploit blind XXE using collaborator HTTP/DNS callbacks and error-based techniques to confirm file disclosure when application responses lack direct entity reflection. This approach handles scenarios where classic DOCTYPE payloads fail to return parsed content.

Can I trigger XXE by uploading SVG or OOXML files like docx and xlsx?▼

Yes, you can trigger XXE via server-side parsing of uploaded SVG and Office OOXML files (docx/xlsx/pptx). Craft payloads inside these formats to execute XML external entity attacks during document processing workflows.

What is the best way to chain XXE to SSRF for deeper network access?▼

The best way to chain XXE to SSRF involves crafting payloads that leverage internal entity resolution to target internal network services. This technique escalates file disclosure into broader server-side request forgery attacks.

How do I bypass blocked DOCTYPE declarations during XML parsing?▼

Bypass blocked DOCTYPE declarations using XInclude and local DTD injection techniques. These methods achieve entity amplification and file reads when standard entity reflection is filtered by application defenses.

Does this approach work for SOAP and REST XML contexts?▼

Yes, this approach works across SOAP and REST XML contexts, as well as RSS/Atom feeds. It applies classic DOCTYPE and entity payloads to verify and exploit XML external entity weaknesses in various parser implementations.

Related Skills

Explore More Legal & Compliance Skills→
yaklangyaklang
1.6k

xxe-xml-external-entity

Identify and exploit XML external entity vulnerabilities to read local files.

Official
Advanced
sseshachalasseshachala

hunt-sharepoint

Fingerprint on-prem SharePoint deployments to identify version and vulnerability vectors.

Community
Advanced
jayjpatel9717jayjpatel9717

xxe-testing

Detect XXE vulnerabilities in XML-accepting endpoints using OOB DNS/HTTP callbacks.

Community
Advanced
ArianHobson333ArianHobson333
7

xxe

Detect XML External Entity flaws in Java, Python, and .NET XML parsers.

Community
Advanced