How do I install the Web Xxe skill?

Run npx skillmds@latest add noorqureshi/web-xxe in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Web Xxe safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Web Xxe?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Web Xxe free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Web Xxe?

NoorQureshi (@noorqureshi) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Web Xxe by noorqureshi — Agent Skill

Name: Web Xxe
Author: NoorQureshi

Web Xxe

XML External Entity injection → file read, SSRF, sometimes RCE. Load when the app parses XML you supply: SOAP, SAML, XML APIs, SVG/DOCX/XLSX upload, RSS import, `Content-Type: application/xml`. Signals: XML request bodies, "<?xml", SAML responses, file parsers.

NoorQureshi 837a0c8 2 files · 4.7 KB Updated Sep 17, 2026

File contents

XML External Entity (XXE)

When it applies

The server parses attacker-supplied XML with external entities enabled. Any XML sink counts — SOAP, SAML, REST-with-XML, and file formats that are XML underneath (SVG, DOCX, XLSX).

Why it works

XML DTDs can declare entities that the parser resolves — including SYSTEM entities that read local files or fetch URLs. If the parser doesn't disable external entities (the insecure default in many libs), your entity is expanded server-side.

Method

Payloads & full variation set: cheatsheet.md next to this file — work the set, not the first line.

Detect: inject a DOCTYPE with an external entity and reference it: <!DOCTYPE r [<!ENTITY x SYSTEM "file:///etc/passwd">]> then <r>&x;</r> — file contents in the response = in-band XXE.
Blind / OOB: no reflection → use an external DTD on your server that exfils via a parameter entity to your Collaborator (file:/// → your URL). DNS/HTTP hit confirms.
SSRF via XXE: point the entity at internal URLs / 169.254.169.254 (→ cloud-imds-ssrf).
File formats: unzip a DOCX/XLSX, inject XXE into an inner XML part, rezip, upload; SVG upload → XXE.
Error-based: force a parse error that echoes file content in the message when output is suppressed.

Gotchas

Modern parsers disable external entities by default — a null result may mean patched, not absent; try OOB + error-based.
php://filter base64 wrapper reads files that break XML (binary/<).
SAML XXE is high-impact but often behind signature checks — test the pre-validation parse.

Verify success

Local file contents returned/exfiltrated, or an OOB callback proving the parser fetched your URL.

References

PortSwigger XXE labs; OWASP XXE Prevention Cheat Sheet.

---name: web-xxedescription: XML External Entity injection → file read, SSRF, sometimes RCE. Load when the app parses XML you supply: SOAP, SAML, XML APIs, SVG/DOCX/XLSX upload, RSS import, `Content-Type: application/xml`. Signals: XML request bodies, "<?xml", SAML responses, file parsers.---# XML External Entity (XXE)## When it appliesThe server parses attacker-supplied XML with external entities enabled. Any XML sink counts —SOAP, SAML, REST-with-XML, and file formats that are XML underneath (SVG, DOCX, XLSX).## Why it worksXML DTDs can declare entities that the parser resolves — including `SYSTEM` entities that readlocal files or fetch URLs. If the parser doesn't disable external entities (the insecuredefault in many libs), your entity is expanded server-side.## Method> **Payloads & full variation set:** [`cheatsheet.md`](cheatsheet.md) next to this file — work the set, not the first line.1. **Detect**: inject a DOCTYPE with an external entity and reference it: `<!DOCTYPE r [<!ENTITY x SYSTEM "file:///etc/passwd">]>` then `<r>&x;</r>` — file contents in the response = in-band XXE.2. **Blind / OOB**: no reflection → use an external DTD on your server that exfils via a parameter entity to your Collaborator (`file:///` → your URL). DNS/HTTP hit confirms.3. **SSRF via XXE**: point the entity at internal URLs / `169.254.169.254` (→ `cloud-imds-ssrf`).4. **File formats**: unzip a DOCX/XLSX, inject XXE into an inner XML part, rezip, upload; SVG upload → XXE.5. **Error-based**: force a parse error that echoes file content in the message when output is suppressed.## Gotchas- Modern parsers disable external entities by default — a null result may mean patched, not absent; try OOB + error-based.- `php://filter` base64 wrapper reads files that break XML (binary/`<`).- SAML XXE is high-impact but often behind signature checks — test the pre-validation parse.## Verify successLocal file contents returned/exfiltrated, or an OOB callback proving the parser fetched your URL.## ReferencesPortSwigger XXE labs; OWASP XXE Prevention Cheat Sheet.

Frequently asked questions