Hunt Xxe
Hunting skill for xxe vulnerabilities.
Install
npx skills add Zyrexnn/Cybermes --skill hunt-xxe -g -a claude-code -y- Repository
- Zyrexnn/Cybermes987
- Category
- Documents
- Updated
- 3d ago
- License
- Apache-2.0
- Context cost
- Mediumabout 3,000 tokens
- Runs scripts
- No, instructions only
What it does
Hunting skill for xxe vulnerabilities. Built from 10 public bug bounty reports including SVG-upload XXE, Office-doc (PPTX/DOCX) XXE, SOAP XXE, SAML AssertionConsumer XXE, blind OOB XXE via DTD callback, parameter-entity XXE, XXE-to-LFI, XXE-to-SSRF, and XXE-to-RCE chains (Adobe Commerce CosmicSting CVE-2024-34102). Use when hunting XXE on any target, emphasis on OOB-Or-It-Didn't-Happen Gate for blind cases.
Crown Jewel Targets
XXE is a critical-severity vulnerability that consistently pays at the top of bug bounty scales ($5,000, $30,000+) due to its direct path to sensitive data exfiltration and SSRF. Highest-value targets:
- Large enterprise platforms with XML-heavy backend integrations (finance, logistics, ride-sharing APIs)
- Domains with file-read capability,
/etc/passwd,/etc/shadow, internal config files, AWS metadata endpoints - Subdomains sharing backend infrastructure, one XXE endpoint can pivot to internal services across dozens of domains (as demonstrated by 26+ Uber domains via a single entry point)
- API gateways accepting XML content types, especially REST APIs that silently accept
Content-Type: application/xml - File upload features, SVG, DOCX, XLSX, PDF, PPTX parsers on the server side
- SAML/SSO endpoints, SAML assertions are XML-based and frequently vulnerable
- Office/document processing services, any feature that converts or processes user-supplied documents
Attack Surface Signals
URL Patterns
/api/v*/xml
/upload
/import
/parse
/convert
/saml/acs
/sso/saml
/feed
/rss
/sitemap
/webdav
/soap/*
/wsdl
/service.asmx
/xmlrpc
/graphql (multipart with XML)
Request/Response Headers
Content-Type: application/xml
Content-Type: text/xml
Content-Type: application/soap+xml
Content-Type: multipart/form-data ← check file upload fields
Accept: application/xml
X-Content-Type-Options: (absent, good sign of loose parsing)
JavaScript Patterns (source recon)
// Look for in JS bundles
XMLSerializer
DOMParser
parseFromString
new ActiveXObject("Microsoft.XMLDOM")
$.parseXML(
xml2js
libxmljs
lxml
