domains / families / security / xslt-injection

xslt-injection

separate

XSLT injection testing: processor fingerprinting, XXE and document() SSRF, EXSLT write primitives, PHP/Java/.NET extension RCE surfaces. Use when user-controlled XSLT/stylesheet input or transform endpoints are in scope.

When to use

• XSLT injection testing
• processor fingerprinting
• XXE and document() SSRF
• EXSLT write primitives
• PHP/Java/.NET extension RCE surfaces
• user-controlled XSLT/stylesheet input
• transform endpoints

When not to use

• generic XML parsing that may not flow through XSLT

Skill page

Source