Skip to content
Get packs

XXE Injection Testing Checklist

Guides an agent through XML External Entity (XXE) vulnerability testing methodology for web apps

Source Download skill
Repository
SnailSploit/Claude-Red
Stars
10,230
Licence
MIT
Files
1 file

What it does

When this skill is active, the agent follows a structured checklist for finding and testing XML External Entity (XXE) flaws, a class of bug where a server's XML parser wrongly reads local files or fetches internal URLs. It covers classic, blind (out-of-band), error-based, XInclude, SVG/docx upload, and SOAP/REST variants, and tracks which checks have been done and suggests next steps. It is written for offensive security testing and bug bounty work, so its output is attack-oriented guidance rather than a defensive fix list.

Great for

  • Security professionals doing authorised web application penetration tests
  • Bug bounty hunters working on in-scope targets
  • Students learning how XXE vulnerabilities are discovered and tested in a lab

Skip it if

  • Developers who only want to harden their parser: the skill focuses on attacking, not on configuration fixes (it is a reason to look elsewhere, not a risk in itself)
  • Testing systems you do not own or have written permission to test, since the payloads target file reads, SSRF and DoS and could cause real harm or break the law
  • Production systems with no authorisation, where file-disclosure or denial-of-service payloads could expose data or cause outages

Try asking

  • “Use the XXE checklist to test this SOAP login endpoint on my authorised lab target for classic and blind XXE”
  • “Walk me through testing an SVG upload feature for XXE, in order, and track what I've completed”
  • “Suggest XXE payloads for a JSON API I can switch to application/xml content type, and what to check next”
Step-by-step guide: how to use XXE Injection Testing ChecklistInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 1 original files, the MIT licence and an attribution note.

    offensive-xxe.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip offensive-xxe.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip offensive-xxe.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Only use it against systems you are explicitly authorised to test, and state the scope in your prompt so the agent stays within it
  • Provide a callback listener or lab domain you control for blind XXE checks rather than third-party servers
  • Ask the agent to log each checklist item as done so you can produce a clear test report

What's inside

  • SKILL.md

Redistributed unmodified from SnailSploit/Claude-Red under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.