Xxe Xml External Entity

This is a comprehensive XXE exploitation playbook that covers far more than the basic file read examples most security guides stop at. It walks through out-of-band exfiltration techniques, which are critical when servers parse XML but don't reflect entity content back to you. You get practical attack chains like converting JSON endpoints to XML parsers, injecting entities into Office documents and SVG files, and pivoting from XXE to SSRF against internal services. The protocol handler section covers PHP wrappers, gopher for Redis exploitation, and base64 encoding to handle binary files. If you're testing XML parsers in any context, including SOAP endpoints, file upload flows, or PDF generators, this gives you the full toolkit with real CVE-based scenarios.

skills.sh installs: 3.8K
GitHub stars: 2.6K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add yaklang/hack-skills --skill xxe-xml-external-entity --agent claude-code

Installs into .claude/skills of the current project.

Files

SKILL: XML External Entity Injection (XXE) — Expert Attack Playbook

AI LOAD INSTRUCTION: Expert XXE techniques. Covers all injection contexts (SOAP, REST JSON→XML parsers, Office files, SVG), OOB exfiltration (critical when direct read fails), blind XXE detection, and XXE-to-SSRF chain. Base models often miss OOB and non-XML context XXE. For real-world CVE chains, Office docx XXE step-by-step, PHP expect:// RCE, and Solr XXE+RCE, load the companion SCENARIOS.md.