enjoiz/XXEinjector

Health v2 · maintenance only

Flags: no_releases no_license

Adoption not part of the score

1795 stars · 325 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

XXEinjector is a Ruby command-line tool that automates exploitation of XML External Entity (XXE) vulnerabilities using direct and out-of-band methods such as FTP, HTTP, and Gopher. It can retrieve files, enumerate directories, steal Windows hashes, execute commands via PHP expect, and upload files.

Use cases

• automatically exploit XXE vulnerabilities in web applications
• retrieve files from a server via out-of-band XXE
• enumerate directories in vulnerable Java applications
• bruteforce file paths through XXE injection
• test for XSLT injection and second-order XXE
• steal Windows hashes or run commands via PHP expect during a pentest

When to choose

• you are doing authorized penetration testing of web apps with XML input
• you need automated direct and OOB XXE exploitation with multiple protocols
• you want extras like PHP filter encoding, file upload, or command execution via XXE

When to avoid

• you need a general-purpose web vulnerability scanner rather than an XXE-specific tool
• you require a maintained tool with a license and active development
• you are not authorized to test the target system

Facets

cli-tool · maturity maintenance

penetration-testing security cli security penetration-testing developer-tools cli windows xxe xml-external-entity exploitation out-of-band ruby offensive-security web-security linux macos

Member repositories

For agents

markdown · JSON · MCP: product_card(name="enjoiz/XXEinjector")