Individual skill

xslt-injection

XSLT 注入测试方法论。当目标存在用户可控的 XSLT/样式表输入、XML 转换端点、报表生成器、XML→HTML 转换器时使用。覆盖处理器指纹识别(Xalan/Saxon/libxslt/MSXML)、XXE via XSLT(DTD外部实体)、document() SSRF/文件读取、EXSLT 文件写入、PHP php:function RCE、Java Saxon/Xalan 扩展 RCE、.NET msxsl:script RCE。完全零覆盖漏洞类型——任何涉及 XSLT、XML 样式表、XML 转换的测试都应使用此 skill

skills/exploit/web-method/xslt-injection/SKILL.md

Source commit c0d3a4645f26be5b94f64344b501db4191dc9788

What was checked

Matches the observed repository HEAD

Yes

Scanner rules are current

Yes

Repository scan complete

No

Skill scan complete

No

Observed behavior

Network or broad shell

Last checked

Nov 9, 2026

These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.

Install this skill

Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.

An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.