xxe-xml-external-entity - XXE Attack Surface and Detection Playbook
Provides an XXE playbook covering XML attack surfaces, direct and blind entity testing, file access, OOB callbacks, SSRF chains, and parser-specific contexts.
Tags
Updated: 2026-10-01Capabilities
Typical Inputs
Typical Outputs
What this skill does
- Identify XML attack surfaces
- Test entity expansion
- Detect blind XXE callbacks
- Read local files through entities
- Trigger internal HTTP requests
- Process SVG and Office XML
- Use XInclude imports
- Apply parser bypass techniques
Inputs
- XML request bodies
- SVG uploads
- Office Open XML files
- SOAP requests
- JSON-to-XML requests
- External DTD URLs
- Callback server endpoints
- Local DTD paths
Outputs
- Reflected entity content
- HTTP or DNS callbacks
- File contents in responses
- Error messages containing data
- Internal service responses
- Repackaged Office files
Requirements
- XML-processing endpoint
- Parser supporting external entities
- Network-accessible callback server