domains / families / security / offensive-xxe

offensive-xxe

separate

A checklist for testing XML External Entity (XXE) injection vulnerabilities in web applications, covering classic, blind, and error-based XXE, as well as XInclude attacks and filter bypasses.

When to use

• classic XXE
• blind XXE
• out-of-band XXE
• XXE via file upload
• SVG XXE
• SOAP XXE
• XInclude attacks
• XXE filter bypass

Skill page

Source