What problem does it solve? When an application passes user-controlled input into server-side XSLT stylesheets or transform endpoints, testers need a structured way to confirm execution, identify the processor, and escalate impact without guessing payloads blindly. ## Core Features & Use Cases - Processor Fingerprinting: Uses system-property() probes to identify Xalan, Saxon, libxslt, or Microsoft XSLT engines before choosing an attack path. - File Read and SSRF: Covers DTD-based XXE and document() payloads for local file reads and out-of-band HTTP callbacks. - Platform-Specific Escalation: Documents EXSLT file writes, PHP php:function abuse, Java extension functions, and .NET msxsl:script RCE, each gated on the detected engine. - Use Case: During an authorized web assessment you find a report generator accepting an XSLT stylesheet parameter; follow the decision tree to fingerprint the engine, prove execution with a harmless marker, then escalate to document() SSRF or file write where the configuration permits. ## Quick Start Use the xslt-injection skill to test the stylesheet parameter on the target transform endpoint, starting with processor fingerprinting and escalating per the detected engine.
