Attack Afternoon – XXE

Aug 2, 2019

You may be familiar with some of the numerous web security acronyms: XSS, CSRF, … But have you heard about XXE?
XML External Entity (XXE) attacks are gaining more attention recently, after having been underestimated for a long time.

Whenever your application parses XML files, it usually expects them to comply with a certain format. An attacker, however, can try to add new XML entity definitions into the file. XML supports a concept called “external entities”, which lets you access local or remote content. If your XML processor allows such external entities, the attacker may be able to exploit it in order to read out sensitive local files on your server, for instance.

Unfortunately, most XML parsing libraries process external entities by default. So it is always a good idea to check your configuration regarding this aspect!

Do you want to make sure that your application does not contain XXE vulnerabilities? Ask us for an analysis now! 

Further reading at the OWASP

Attack Afternoon - XXE

Recent posts

Tool Tuesday – nmap

One tool which should be installed on every pentester PC is nmap. This command line tool is the Swiss army knive for penetration tests on network level, but also used regularly by system administrators.

read more

mgm sp @ Munich

Our head office is located in the heart of Bavaria, since the time of SecureNet. Come have a look!

read more

Awareness Training @ mgm sp

One of the most important fundamentals for practiced security is the creation of awareness for threats in information security. In our IT Security Awareness Training, we demonstrate how attackers act, what motivates them and how easy it is to do damage.

read more

Wenn Sie auf der Seite weitersurfen, stimmen Sie der Cookie-Nutzung zu.
If you continue to visit the site, you agree to the use of cookies.
Privacy Policy / Cookie Policy

The cookie settings on this website are set to "allow cookies" to give you the best browsing experience possible. If you continue to use this website without changing your cookie settings or you click "Accept" below then you are consenting to this.