Standardmäßig ist der Prompt ausgewählt, der zuerst die Quelle prüft. Sie können zu einem direkten Befehl wechseln oder eine lokale Kopie herunterladen.
Quelldateien prüfen
Lesen Sie SKILL.md und alle von SkillsMP angezeigten Begleitdateien, bevor Sie sich für eine Installation entscheiden.
Mit Codex oder Claude installieren Kopieren Sie diesen Prompt, fügen Sie ihn in Codex, Claude oder einen anderen Assistant ein und lassen Sie die Skill-Seite prüfen und installieren.
Ein direkter Befehl überspringt den Prüf-Prompt. Prüfen Sie die Quelle, bevor Sie ihn ausführen.
GraphQL IDOR/auth-bypass, XXE file-read/SSRF (SVG/DOCX/SAML), SSTI detection and RCE. OOB-mandatory for blind XXE. Wiki-first, FIND schema output.
Hunt: GraphQL / XXE / SSTI
Assumes hunt-core for the scope gate, two-account rule, confirmation gate, enumeration limits, stop conditions, wiki protocol, FIND output, and Deadends. Do not re-derive any of that here.
Wiki
qmd_query "SSTI XXE GraphQL injection template injection XML external entity" via wiki-search MCP
Use InQL (Burp extension) or graphql-voyager to map schema. Push load-bearing queries/mutations to Burp Repeater (Skill(hunt-burp) / the Burp MCP) so the operator can replay them.
Find REST/GraphQL overlap - resources modifiable via BOTH APIs
Test IDOR: replay queries/mutations with another user's object IDs
Test authorization: lower-privilege user calling admin mutations
Test for persistent privilege after REST revokes access - GraphQL re-grants?
Evasion
Introspection disabled -> {"query":"{ __typename }"} confirms GraphQL is live; then field-suggestion mining (typo a field, the error often names valid ones), alias-based enumeration for parallel object access, and query batching (array body) to bypass per-request rate limits and some auth checks.
XXE
Attack Surface (ranked)
/upload /import /parse /convert /saml/acs /soap/*
Content-Type: application/xml or text/xml
SVG, DOCX, XLSX, PPTX file upload features
Rank: SAML ACS and document/office upload converters first (parsers there routinely resolve external entities), then any endpoint you can flip to Content-Type: application/xml.
XML/DTD rejected -> switch vector (SVG/DOCX/XLSX/PPTX upload, or a Content-Type: application/xml swap on a JSON endpoint), UTF-16/UTF-7 re-encode the payload, wrap the leaked file through php://filter/convert.base64-encode/resource= for binary/PHP source, and use parameter entities + an external DTD when the inline DOCTYPE is blocked.
SSTI
Detection Probes (try all - different engines respond to different syntax)
Prove RCE with a harmless command (id / whoami) first - as the payloads above do. Never lead with a destructive command to demonstrate execution.
Where to Test (ranked)
Highest yield first: PDF/invoice generators and email-template fields (server-side render by design), then name/bio/description fields, invoice names, search queries reflected in results, URL path parameters, and HTTP headers reflected in responses.
Evasion
{{7*7}} filtered or returned literally -> cycle every engine syntax above, then bypass keyword filters via attribute-access variants (request["application"] vs request.application), string concatenation to rebuild blocked names, and hex/unicode escapes. WAF on __class__ -> |attr('__class__').
Chaining
SSTI -> RCE. Evaluation confirmed -> escalate to command execution with the engine payload above (safe command first). For sandbox-escape gadget chains and OOB-blind RCE, hand off to hunt-rce.
XXE -> SSRF / file read. Point the external entity at http://169.254.169.254/... for cloud metadata or an internal service; for the full SSRF surface (redirect bypass, protocol smuggling, Collaborator-gated blind) hand off to hunt-ssrf. File read escalates to source/config disclosure and, through those, to further creds.
GraphQL IDOR / auth bypass -> object enumeration. Nested-resolver and node(id:) traversal are IDOR - hand off to hunt-idor (two-account method) or hunt-api (BOLA/BFLA, mass assignment, batching).
Confirmation gate
Per hunt-core. Reproduce every claim in a clean session before scaffolding a FIND; a response body on its own is not proof.
SSTI - NOT confirmation: a {{7*7}} (or ${7*7} / <%= 7*7 %>) reflected back literally as {{7*7}}; an error naming the template engine; input echoed unchanged.
SSTI - IS confirmation: the expression is evaluated - {{7*7}} renders 49, {{7*'7'}} renders 7777777, or a rendered object comes back (e.g. a dumped config object). RCE is confirmed only when a safe command (id / whoami) returns its real output.
XXE - NOT confirmation: a parser error, a 500, or "entity not allowed" - these prove XML is parsed, not that the entity resolved.
XXE - IS confirmation: the external entity resolves to real content - /etc/passwd (or metadata creds) reflected in the response, OR an out-of-band callback.
Blind XXE / blind SSTI need an OOB HIT. When you plant a blind/OOB payload (parameter-entity XXE, or SSTI with no reflected sink), fire it at your own interactsh/Collaborator listener and append a row to targets/<eng>/oob.md:
(columns: token | sink | class | planted | status | source; token = your unique interactsh/Collaborator label). The recon-capture hook flips the row waiting -> HIT on the incoming callback and SessionStart surfaces HITs; that HIT row is the confirmation gate to scaffold the FIND. Do NOT claim a blind XXE (or blind SSTI) without a HIT row.
Append: - [ ] XXE on <host> -- XML rejected (JSON-only), SVG sanitized, parameter entities blocked;
SSTI -- {{7*7}} literal across all engines; GraphQL -- introspection off, no field suggestions
Record what you tried, not just that it failed. The next pass needs the boundary.
