skills.rest
hhjkjkjk
hhjkjkjkCOMMUNITY
Explore all skills by this author →
GitHub

hunt-xxe

Detects and exploits XXE vulnerabilities across XML endpoints, file uploads, and SAML services.

Updated May 29, 2026
Search Tags:#penetration testing#file upload#xml#ssrf#bug bounty#xxe#blind oob
One-click install
npx skills add https://github.com/hhjkjkjk/Claude-skills --skill hunt-xxe-hhjkjkjk
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-xxe
Source: https://github.com/hhjkjkjk/Claude-skills/tree/main/skills/hunt-xxe
Command: npx skills add https://github.com/hhjkjkjk/Claude-skills --skill hunt-xxe-hhjkjkjk

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? XXE vulnerabilities hide in XML parsers behind APIs, file uploads, and SSO endpoints, and most testers miss them because modern parsers vary widely in default behavior. This Skill provides a systematic hunting methodology built from 10 real bug bounty reports so you can find, validate, and prove XXE impact without wasting time on hardened parsers. ## Core Features & Use Cases - Attack Surface Mapping: Identifies XML entry points via URL patterns, Content-Type headers, JavaScript parsing calls, and tech-stack signals across Java, PHP, Python, Ruby, and .NET stacks. - Payload Library with Bypasses: Provides in-band file read, blind OOB parameter-entity exfiltration, SSRF via XXE, SVG/DOCX upload payloads, and WAF/egress-filter bypass techniques. - Parser Vulnerability Matrix: Fingerprints whether the target parser expands external entities before you invest effort, using an inline-entity probe as a pre-severity gate. - Use Case: While testing a REST API that accepts JSON, swap Content-Type to application/xml, inject a blind OOB entity pointing at Burp Collaborator, confirm the DNS callback, then escalate to exfiltrate /etc/passwd via a two-stage parameter-entity DTD and document the full impact chain for the report. ## Quick Start Ask the AI to test a specific endpoint for XXE using the inline-entity probe first, then escalate to blind OOB exfiltration if the parser resolves entities.

Frequently Asked Questions about hunt-xxe

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test an API endpoint for XXE vulnerabilities?▼

Start by swapping the request Content-Type to application/xml and injecting an inline entity probe like <!ENTITY hello "world!"> referenced in a node. If the value echoes back, escalate to SYSTEM file reads or blind OOB callbacks via Burp Collaborator.

How to exploit blind XXE when no output is reflected?▼

Use a two-stage parameter-entity payload: host an external DTD on your server that reads a local file and sends its contents to your listener via HTTP or DNS. Confirm the callback in Burp Collaborator or interactsh before claiming the finding.

Which XML parsers are vulnerable to XXE by default?▼

Java SAX/DOM without hardening, PHP DOMDocument with LIBXML_NOENT, older .NET XmlReader, and legacy Struts are vulnerable by default. Python xml.etree, modern lxml, and default Ruby Nokogiri disable external entities and are generally safe.

Can XXE work through file upload features like SVG or DOCX?▼

Yes. SVG files accept DOCTYPE declarations directly, and DOCX/XLSX/PPTX files are ZIP archives of XML parts where you can inject entities into document.xml or [Content_Types].xml. Server-side parsers often resolve entities when rendering or thumbnailing uploads.

Why does my XXE payload fail to trigger any callback?▼

The parser likely has external entities disabled, or network egress filtering blocks outbound requests. Run the inline-entity probe first; if it fails, the parser is hardened. If inline works but OOB fails, try DNS-only exfiltration or error-based exfiltration.

What evidence is needed to report XXE as critical severity?▼

You must demonstrate actual data exposure: show /etc/passwd contents in the response, exfiltrate a file to your OOB server, or reach internal services like AWS metadata at 169.254.169.254. A bare DNS callback without data exfiltration rates only Low to Medium.

Related Skills

Explore More Software Engineering Skills→
Mikacr1138Mikacr1138
2

web2-recon

Automate web2 reconnaissance from subdomain enumeration to JS analysis.

Community
Intermediate
dreadnodedreadnode
11

pacu-aws-exploitation

Execute Pacu modules to enumerate IAM permissions during authorized AWS web security assessments.

Official
Intermediate
uphiagouphiago
1.1k

hunt-ssrf

Detect and validate SSRF vulnerabilities with out-of-band confirmation.

Community
Advanced
sayseven7sayseven7
11

upload-insecure-files

Analyze insecure file upload workflows for validation bypasses and exploitation chains.

Community
Advanced