XML external entity (XXE)
Challenges
- Exploiting XXE to retrieve files
- Exploiting XXE to perform SSRF
- Blind XXE with out-of-band interaction
- Blind XXE with out-of-band interaction using parameter entities
- Blind XXE with out-of-band exfiltration
- Blind XXE with data retrieval via error messages
- XInclude attack
- XXE via file upload
- Blind XXE: Trigger error message by repurposing local DTD
Resources
Last updated on