xxe
Hunt XML External Entity flaws in parsers and validate file read / SSRF impact with strict negative controls.
Best for security testingWorks with GitHubHigh risk
⌘source
- author
@PurpleAILAB- language
- Python
★2.1kstars
366forks
Apr 18, 2026
✦overview.md
Key Features
- ·Identifies XML parser sinks in Java, Python, and .NET
- ·Detects dangerous default parser configurations
- ·Tests for file read and SSRF vulnerabilities
- ·Uses positive and negative validation controls
- ·Provides specific payload examples
Use Cases
- →Security engineers testing XML parsers for external entity vulnerabilities
- →Developers validating XML processing code before deployment
- →Penetration testers assessing application security for XXE flaws
- →Code reviewers checking for insecure XML parser configurations
Best for
- ✓security testing
- ✓vulnerability assessment
- ✓code review
Not ideal for
- !production environments
- !non-XML systems
- !automated remediation
FAQs
name
xxe
description
Hunt XML External Entity flaws in parsers and validate file read / SSRF impact with strict negative controls.
XXE Playbook
Find parser sinks
- Java:
DocumentBuilderFactory,SAXParserFactory,XMLInputFactory - Python:
lxml.etree,xml.dom.minidom,xml.sax - .NET:
XmlDocument,XDocument,XmlReader
Dangerous defaults
- DTD enabled
- External entities enabled
- Network/file entity resolution enabled
Payloads
- File read: entity to
file:///etc/passwd - SSRF: entity to internal URL (metadata service, localhost admin)
Validation
- Positive: parser output contains file content or internal response markers.
- Negative: same XML without entity expansion must not leak content.
$install
1-click copynpx skills add PurpleAILAB/Decepticon --skill xxeSafety assessment
★
Clarity score
How clear and easy to understand the SKILL.md instructions are, rated from 1 to 5.
4/ 5
very goodClear and well structured, with only minor parts that might need a second read.
◎
Actionability score
How directly an agent can act on the SKILL.md instructions, rated from 1 to 5.
4/ 5
highMostly actionable with clear steps; only a few small gaps remain.