import aiohttp
from modules.payloads import manager
async def test_xxe(url: str, method: str = "POST") -> dict:
"""
Tests for XXE using PayloadsAllTheThings payloads.
"""
findings = []
payloads = manager.get_payloads('xxe', limit=20)
async with aiohttp.ClientSession() as session:
for payload in payloads:
try:
# Basic assumption: URL accepts XML body
# Real implementation needs Content-Type headers etc.
headers = {"Content-Type": "application/xml"}
async with session.request(method, url, data=payload, headers=headers, timeout=5) as response:
text = await response.text()
# Basic detection signatures
if "root:x:0:0" in text or "boot.ini" in text or "error" in text.lower():
findings.append({
"type": "XXE",
"payload": payload,
"evidence": text[:100] # Snippet
})
except Exception:
continue
return {
"url": url,
"scanned_payloads": len(payloads),
"vulnerabilities": findings
}
