kamalx06/xxeripperBlack-box XXE scanner detecting in-band, error-based, and blind out-of-band injection via statistical baselining, parser fingerprinting, and OOB confirmation, with SARIF output.
A standalone, black-box XML External Entity (XXE) scanner for security professionals.
XXERipper detects in-band, error-based, and blind out-of-band XXE across 30+ attack technique families. It combines statistical baselining, differential parser fingerprinting, out-of-band confirmation via interactsh-client (manual or automatic), a browser-based console, WAF-bypass encoding, end-to-end exploit-chain detection, credential extraction with paste-ready shell snippets, CWE-mapped findings, and JSON / SARIF / HTML output for CI/CD and reporting.
XXERipper is a self-contained CLI and browser-console scanner for XML External Entity injection, designed for penetration testers, bug-bounty hunters, and security researchers who need accurate, low-false-positive detection of a vulnerability class that is easy to test badly and hard to test well.
It is deliberately minimal — httpx and (for the console) flask, nothing else — and end-to-end auditable. Every phase can be traced, every finding carries an evidence trail, every skipped technique is reported with a reason, and every extracted file or credential is deduplicated and stored with paste-ready exploitation snippets.
XXERipper does not exploit the target beyond the entity-resolution primitive itself. It determines whether a parser resolves external entities, whether the result can be observed in-band, via parser errors, or out of band, and reports that determination with a confidence score, a CWE mapping, and — when a full chain completes — a rollup finding that names the end-to-end impact.
ChainTracker observes every finding, derives chain stages from ID + evidence, and fires a rollup finding when a template completes — XXE → IMDS → IAM credentials → AWS account takeover, XXE → SSH private key → lateral movement, XXE → Kubernetes secrets → cluster credential theft, and ten more.aws sts get-caller-identity, aliyun sts GetCallerIdentity, ssh -i …, gcloud auth activate-service-account, kubectl --token=…, and curl -H 'Authorization: Bearer …' — built with the token's real claims where applicable.interactsh-client. Two modes: manual (scanner prints every subdomain, you watch the client) and auto (--oob-auto spawns interactsh-client and correlates callbacks in-process). Both embed a unique 16-hex token per payload so callbacks can never be misattributed.--oob-listen), a directory served by your own web server (--oob-dtd-dir), or the WebUI's own Flask routes (tick Serve DTDs from this WebUI in the drawer).jar://, data://, phar://, glob://, compress.zlib://.XXE-OFFICE-XSLT-{DOCX,XLSX}) — an xml-stylesheet PI inside a Word or Excel part causes server-side document processors to fetch an attacker-controlled XSLT.jackson-dataformat-xml on the classpath, which silently accepts application/xml on any @RequestBody endpoint.--bypass-waf) — re-sends the entire payload catalogue through fifteen encoders across three families. Runs after the core phases so a direct hit is found in ~20 requests instead of being buried behind ~1,500 encoded ones.--serve) — browser-based workbench with live event streaming, command palette, keyboard-driven navigation, per-job JSON / SARIF / HTML downloads, and a separate View HTML button that opens the report inline instead of downloading it. Zero-dependency frontend: one self-contained HTML file, no CDN.--pre-auth-request FILE replays Burp-format requests and merges their Set-Cookie before the scan starts, so multi-step auth flows work without a cookies file.