PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

XML external entity: The ultimate Bug Bounty guide to exploiting XXE vulnerabilities

yeswehack.com | blog | #bug-bounty | #cloud | #rce | #web-security | #ssrf | #xxe | #xml | #file-disclosure
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

The ultimate XXE guide: abusing XML parser entity handling for file disclosure, internal reconnaissance, cloud metadata theft — even via DOCX uploads — and RCE in some configurations.
Published
Collected

Related coverage

vulnerability · vercel.com
Our $1 million hacker challenge for React2Shell
We paid $1M to security researchers to break our WAF. Here's what we learned defending against React2Shell.
blog · yeswehack.com
Dojo challenge #42 - Hex Color Palette winners & writeup
Dojo #42 'Hex Color Palette' writeup: exploiting an XXE in the lxml library via error-based exfiltration to leak /tmp/flag.txt; winners 0necloud, Cryptocat and 3c4d.
blog · hackenproof.com
Inside American Express India's Cloud Storage Exposure
An open MongoDB exposed 3M American Express India records, including Aadhaar and PAN numbers. What happened, and does Amex run a bug bounty today?
blog · vercel.com
Mitigating Denial of Wallet risks with Vercel
Protect against Denial of Wallet (DoW) attacks with Vercel. DoW exploits cloud scalability to inflate costs. Vercel provides solutions like budget alerts, spend limits, and anomaly detection to safeguard workloads and maintain financial stability.
blog · vercel.com
Introducing Vercel Firewall and Vercel Secure Compute
Vercel Secure Compute and Vercel Firewall for enhanced protection of your applications on the frontend cloud
blog · netspi.com
XXE in IBM's MaaS360 Platform
Cody Wass recounts discovering an XXE vulnerability in a service behind IBM's MaaS360 MDM platform, with a primer on external XML entities and how parser abuse enables file reads and SSRF.
Back