This is a collection of writeups, cheatsheets, videos, related to XXE in one single location
This is currently work in progress I will add more resources as I continue my learning.
Created By @jdonsec
-
PortSwigger: XML Entities [READ this first!]
-
OneHackMan: Exploiting XML External Entity (XXE) Injections [Read this second!]
-
PortSwigger: Finding and Exploiting bling XXE Vulnerabilities
-
XXE that can Bypass WAF Protection [WAF Bypass]
-
#312543 XXE in Site Audit function exposing file and directory contents
-
#248668 XXE on sms-be-vip.twitter.com in SXMP Processor [Great report example]
-
#232614 Uploaded XLF files result in External Entity Execution
-
#36450 send.qiwi.ru Soap-based XXE vulnerability /soapserver/
-
#500515 XXE at ecjobs.starbucks.com.cn/retail/hxpublic_v6/hxdynamicpage6.aspx
-
#836877 XXE through injection of a payload in the XMP metadata of a JPEG file
-
#105753 app.informaticaondemand.com XXE Looks interesting wish the report was much better so we could all learn from it.
-
#106865 rev-app.informatica.com - XXE via SAML Same here wish the report was better