XXEinjector

ruby XXEinjector.rb --host=<attacker> --file=<request.txt>

Tool for exploiting XXE (XML External Entity) with support for file extraction, SSRF, and command execution.

When you find an endpoint that processes XML (e.g., SOAP, REST with XML). XXEinjector automates the injection of external DTDs to read files, scan ports, or even execute commands (if combined with SSRF).

If the XML is sanitized or a parser that disables external entities is used. Also if the target does not return responses that show the contents of the files.