xxe-xml-external-entity

XML External Entity exploitation involves injecting malicious entity definitions into XML parsers to read internal files or execute requests. This Skill provides expert-level guidance on detecting and exploiting XXE attacks across contexts like SOAP, REST, and SVG.

Blind XXE detection identifies vulnerabilities that do not directly reflect entity content in responses. This Skill explains techniques for discovering these hidden XXE flaws by using out-of-band channels to infer entity resolution success.

Yes, XXE-to-SSRF chains combine XML entity injection with Server-Side Request Forgery to map internal networks. This Skill details how to leverage XXE vulnerabilities to perform internal network reconnaissance via SSRF.

Preventing XXE attacks requires proper XML parser configuration and strict input validation. This Skill outlines defensive strategies, including disabling external entity resolution and DTD processing to secure applications.

Yes, this Skill provides detailed explanations and examples of XXE attacks across various contexts, including Office files, SVG, SOAP, and REST. It covers detection, exploitation, and mitigation strategies for these formats.

Yes, understanding XML parsing and network protocols is required to use this Skill effectively. It provides expert-level exploitation and defense techniques that assume foundational knowledge of how XML processors handle entities.