xxe-injection-methodology

MALICIOUS. 这是一个面向 AI 代理的 XXE 攻击技能，核心用途是发现漏洞、读取敏感文件、触发 SSRF，并通过外带通道窃取数据。虽无典型安装型供应链投毒，但其实际能力属于高风险进攻与数据外泄，不适合作为普通技能分发。

该片段不是可执行代码或供应链植入物，而是明确面向 XXE、文件读取、SSRF 和数据外带的攻击技术文档。若其中载荷被传入存在不安全配置的 XML 解析器，可能造成敏感文件泄露、云凭证访问和内网探测。片段本身未发现恶意运行时行为、持久化、凭据窃取实现或混淆代码。

This fragment is explicit XXE exploitation guidance designed to help an attacker (a) read sensitive local files via file:// entity resolution and reflected output and (b) exfiltrate stolen data out-of-band via attacker-hosted external DTDs that trigger outbound HTTP callbacks. It also includes bypass/evasion and multi-format deployment instructions (SOAP/SVG/DOCX), indicating malicious intent and high practical risk if included in a software dependency or artifact.

This fragment is not executable malware; it is a static instruction set that can be used to generate/validate XXE exploitation payloads, including blind external DTD-based data exfiltration and XML triggering via content-type/DOCTYPE techniques. There are no direct in-module source-to-sink flows, but the embedded attacker-controlled exfiltration guidance materially increases misuse risk for offensive tooling or automated exploit generation.