Skip to main content
Status: Stable Version: 1.0.0 Author: Rifteo Tags: pentest, security, web
Installation

​
Summary

Detect and exploit XML External Entity injection across all attack surfaces from classic file read to blind OOB exfiltration and multi-step escalation chains.
  • Phase 1 finds the attack surface: explicit XML endpoints, hidden XML via Content-Type switching on JSON APIs, file upload vectors (SVG, DOCX, XLSX, ODT, XSL), SAML/SSO flows, SOAP, WebDAV, RSS feeds
  • Phase 2 covers classic XXE with visible output: file read, SSRF, port scanning, multi-file read, and error-based file read
  • Phase 3 covers blind XXE: OOB via DNS confirmation, OOB file exfiltration via external DTD, FTP exfiltration (bypasses HTTP-only egress), multi-line file read via PHP wrapper, and error-based blind XXE
  • Phase 4 targets file upload vectors: SVG injection, DOCX/XLSX/PPTX modification, ODT/ODS, XSL/XSLT injection
  • Phase 5 covers XInclude (works without DOCTYPE control) and Phase 6 covers SAML XXE
  • Phase 8 provides WAF bypass techniques: UTF-16 encoding, chunked transfer encoding, alternate DOCTYPE syntax, CDATA wrappers, and nested parameter entities
  • Phase 9 documents escalation chains: XXE → SSRF → cloud metadata, XXE → SSH key read, XXE → Gopher → Redis RCE

​
SKILL.md file

​
XXE Phantom XML External Entity Injection

​
What Does It Check?

In scope:
  • Classic XXE: <!ENTITY xxe SYSTEM "file:///etc/passwd">
  • SSRF via XXE: <!ENTITY xxe SYSTEM "http://169.254.169.254/...">
  • Blind XXE: OOB DNS/HTTP callback via external DTD
  • XInclude: <xi:include parse="text" href="file:///etc/passwd"/> (no DOCTYPE required)
  • File upload XXE: SVG, DOCX, XLSX, ODT, XSL/XSLT
  • SAML XXE: DOCTYPE injection into base64-decoded SAMLResponse
  • Protocol handlers: file://, http://, ftp://, php://filter, gopher://, netdoc://, expect://
  • WAF bypass: encoding, chunked transfer, DOCTYPE syntax variants, CDATA wrappers
  • Escalation: XXE → cloud metadata, XXE → SSH keys, XXE → Redis RCE via Gopher
Out of scope:
  • Standard JSON API endpoints that don’t accept XML use Content-Type switching to check first

​
How It Works

Phase 1: Find the Attack SurfaceCheck for explicit XML Content-Types, then try switching JSON APIs to XML. Test file upload features with SVG (direct XML) and DOCX/XLSX (ZIP-compressed XML). Intercept SAML flows and decode the base64 assertion.Phase 2: Classic XXE
Phase 3: Blind XXE
Host evil.dtd with entity definitions that exfiltrate file contents via HTTP callbacks.Phase 4: File Upload XXEInject into SVG directly; inject into DOCX/XLSX by unzipping, editing word/document.xml or xl/workbook.xml, and repacking.Phase 5: XInclude
Use when DOCTYPE is blocked but XML element content is user-controlled.Phase 8: WAF Bypass
Phase 9: Escalation Chains

​
Output

​
Known Limitations

  • Parser must evaluate external entities hardened parsers (DTD processing disabled) are not vulnerable
  • Entity syntax appearing literally in the response (&xxe;) means reflection exists but entity expansion is disabled
  • PHP expect:// RCE is rare requires the expect extension to be loaded
  • GCP metadata requires Metadata-Flavor: Google header may not work via XXE if parser doesn’t forward custom headers

ssrf-hunter

Complete SSRF detection and exploitation methodology cloud metadata, internal network, and protocol handler abuse

ssti-hunter

Complete SSTI detection and exploitation methodology across all major template engines

nuclei-template-writer

Convert a vulnerability into a ready-to-run Nuclei YAML template for large-scale detection