skills.rest
utsavthakur
utsavthakurCOMMUNITY
Explore all skills by this author →
GitHub

xxe-xml-external-entity

Exploit and mitigate XXE vulnerabilities in XML, SVG, OOXML, and SOAP.

Updated Jun 11, 2026
Search Tags:#security#vulnerability#exploitation#XML#XXE
One-click install
npx skills add https://github.com/utsavthakur/agenticskills --skill xxe-xml-external-entity-utsavthakur
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: xxe-xml-external-entity
Source: https://github.com/utsavthakur/agenticskills/tree/main/xxe-xml-external-entity
Command: npx skills add https://github.com/utsavthakur/agenticskills --skill xxe-xml-external-entity-utsavthakur

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

This Skill addresses the detection and exploitation of XML External Entity (XXE) vulnerabilities in web applications, providing expert-level guidance and techniques to identify and mitigate such risks.

Core Features & Use Cases

  • XXE Exploitation: Offers detailed strategies for exploiting XXE vulnerabilities in XML, SVG, OOXML, SOAP, and other XML-based contexts.
  • OOXML Injection: Step-by-step guidance on exploiting XXE in Office documents, including .docx, .xlsx, and .pptx.
  • Blind XXE Detection: Techniques for detecting blind XXE vulnerabilities where direct entity reflection is not possible.
  • XXE-to-SSRF Chaining: Combines XXE file read with SSRF to access internal HTTP endpoints.

Quick Start

Use the xxe-xml-external-entity skill to perform a blind XXE test on the target application with the command 'xxe-xml-external-entity -t http://target.com'.

Frequently Asked Questions about xxe-xml-external-entity

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect blind XXE vulnerabilities when the XML parser does not reflect errors?▼

Blind XXE detection involves using out-of-band techniques to confirm XML External Entity processing when direct entity reflection is unavailable. This Skill provides expert techniques for identifying blind XXE vulnerabilities where direct output is not possible.

Can I chain XXE to SSRF to access internal HTTP endpoints?▼

Yes, XXE-to-SSRF chaining combines XXE file read capabilities with Server-Side Request Forgery to access internal HTTP endpoints. This Skill provides techniques to combine XXE file read with SSRF to access internal HTTP endpoints.

How do I exploit XML External Entity vulnerabilities in OOXML files like .docx and .xlsx?▼

XXE exploitation in OOXML files targets the embedded XML structures within Office documents. This Skill offers step-by-step guidance on exploiting XML External Entity vulnerabilities in Office documents including .docx, .xlsx, and .pptx.

What is the best way to test SVG files for XXE injection?▼

Testing SVG files for XXE injection involves crafting malicious entity definitions within the SVG XML structure. This Skill offers detailed strategies for exploiting XXE vulnerabilities in SVG and other XML-based contexts.

How do I perform a blind XXE test on a target web application?▼

You can perform a blind XXE test by running the provided command 'xxe-xml-external-entity -t http://target.com' against your target application. This initiates expert-level blind XXE detection techniques.

Related Skills

Explore More Software Engineering Skills→
cybersecwomancybersecwoman
5

hunt-xxe

Identify XML External Entity vulnerabilities in web applications via XML parsing and file inclusion attacks.

Community
Advanced
SkobynSkobyn

hunt-ssrf

Detect and exploit SSRF vulnerabilities in web applications.

Community
Advanced
zebbernzebbern
4.5k

Red Team Tools and Methodology

Automate red-team reconnaissance and vulnerability discovery workflows.

Community
Advanced
SkobynSkobyn

hunt-xxe

Detect and exploit XXE vulnerabilities in XML content.

Community
Advanced