Playing with Content-Type – XXE on JSON Endpoints

Cody Wass recounts discovering an XXE vulnerability in a service behind IBM's MaaS360 MDM platform, with a primer on external XML entities and how parser abuse enables file reads and SSRF.

A technical walkthrough of XPath injection: how unvalidated input in XML queries enables authentication bypass and data theft, with a vulnerable lab and Burp Suite techniques for identifying the flaw.

Catalogs ten injection points for UNC paths that force SMB authentication back to an attacker, including XXE, broken IMG tags, traversals, database queries, and SharePoint.

Covers an out-of-band XXE technique that uses an external DTD hosted on an attacker server to exfiltrate local files when the vulnerable application does not reflect responses.

Web servers exposing their .git directory hand attackers the full repository history: the article covers finding exposed repos, mirroring them with wget, and recovering source and config data.

Since its formal recognition by the security community in 2007 on the OWASP Top Ten list, Cross Site Request Forgery (CSRF) has stepped out of the shadows and joined the ranks of vulnerability all-stars like Cross Site Scripting (XSS) and SQL injection.