XXExploiter - Tool to help exploit XXE vulnerabilities

XXExploiter generates the XML payloads, and automatically starts a server to serve the needed DTD's or to do data exfiltration.

IMPORTANT: This tool is still under development and although most of its features are already working, some may have not been tested properly.

Installation

#install node and npm if you don't have it yet 
npm install -g xxexploiter

Building and Running from source

This is a simple Node application written with typescript. So you can build it as you build other apps:
(install node and npm first, if you dont have them)

npm install  
npm run build  
#you may need to npm install tsc -g in order for 'npm build' to succeed 

To run the app you can do it with one of two ways:

npm start [args]  
node dist/index.js [args]  

Or you can install it on your system:

npm link

Usage

Usage: xxexploiter.ts [command] [options]

Commands:
  xxexploiter file [file_to_read]  Use XXE to read a file
  xxexploiter request [URL]        Use XXE to do a request
  xxexploiter expect [command]     Use XXE to execute a command through PHP's expect
  xxexploiter xee [expantions]     Generate a huge content by resolving entities

Fuzzing Specific Options
  -f, --fuzz            Enables fuzz options. Use {{FUZZ}} placeholder in....