XML External Entity (XXE) Audit (offensive-xxe)

Authorization & Scope Notice: This skill is part of the REA_Skill + claude-red Unified Security & Reverse Engineering Suite. It is designed strictly for authorized security assessments, defensive architecture reviews, vulnerability triage, bug bounty verification, and remediation engineering on software, infrastructure, and assets you own or have explicit permission to test.

Overview

XML External Entity (XXE) vulnerability assessment covering external DTD loading, parameter entities, blind OOB entity resolution, SVG/DOCX/XLSX XML parsing surfaces, and secure XML parser flags (disabling DOCTYPE and external general/parameter entities). Use when auditing XML, SOAP, SAML, or document upload parsers.

Operational Workflow