Content
76%Weight 40%Scale 1-5Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
A highly actionable, concise XXE reference with copy-paste-ready payloads across all major vectors. Its main weakness is workflow sequencing and validation: the batch file-read loop and blind-XXE exfiltration lack explicit 'confirm reflection' / 'check listener' checkpoints, which caps workflow clarity.
Suggestions
Add an explicit detection-before-exploitation sequence (e.g., 'First confirm XML is parsed and reflected with a benign entity, then escalate to file:// reads') with a numbered workflow before the payload sections.
Insert a validation step after the blind XXE example showing how to confirm exfiltration (e.g., 'grep the listener log for the ?d= parameter and base64-decode it') rather than leaving only a bare '# 3. Check listener' comment.
Trim the opening paragraph that re-describes what XXE is, since it duplicates the frontmatter description — let the section headers carry that load.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The body is mostly lean and code-driven with minimal conceptual padding, but the opening paragraph ('Exploits XML parsers that process external entity definitions, enabling local file reading, SSRF, or denial of service...') restates what the description already covers and could be trimmed — slightly above the midpoint but not the leanest possible. | 4 / 5 |
Actionability | Every section is copy-paste-ready curl/zip commands with full payloads — 'curl -s ... -d '<?xml...<!ENTITY xxe SYSTEM "file:///etc/passwd">...'' — covering detection, basic file read, SOAP, SVG/DOCX/XLSX upload, and blind OOB XXE, matching the fully-executable top anchor. | 5 / 5 |
Workflow Clarity | Sections are topical but lack explicit sequencing and validation checkpoints; the 'Read sensitive credential/config files' batch loop iterates curl over many files with no 'confirm reflection first' or 'check listener for exfiltrated data' validation step for the blind case (the final '# 3. Check listener' is only a bare comment), so per the rubric's destructive/batch cap it cannot exceed 3. | 3 / 5 |
Progressive Disclosure | The single self-contained file is well-organized into clearly headed sections (Detection, Basic XXE, SOAP, File Upload, Blind XXE, Content Types, Pitfalls) with no bundle files to over-nest, giving good structure and easy navigation, though it is monolithic rather than split across one-level-deep references. | 4 / 5 |
Total | 16 / 20 Passed |