XML External Entity (XXE) | Learn AppSec | Invicti
Tags
attack-pattern: Data Direct Indirect Javascript - T1059.007 Python - T1059.006 Server - T1583.004 Server - T1584.004 Software - T1592.002 Web Services - T1583.006 Web Services - T1584.006 Tool - T1588.002 Vulnerabilities - T1588.006 Denial Of Service
Show in Graph
Common Information
Type Value
UUID 99b929fa-4d28-4e86-9d83-6afd921e5660
Fingerprint 901b849afcabcc9d
Analysis status DONE
Considered CTI value 0
Text language
Published Jan. 11, 2023, 9:45 a.m.
Added to db Jan. 18, 2023, 10:46 p.m.
Last updated Nov. 17, 2024, 5:56 p.m.
Headline XML external entity (XXE)
Title XML External Entity (XXE) | Learn AppSec | Invicti
Detected Hints/Tags/Attributes 63/1/10
Source URLs
Redirection Url
Details Source https://www.acunetix.com/blog/articles/xml-external-entity-xxe-limitations/
Details Source https://www.acunetix.com/blog/articles/xml-external-entity-xxe-vulnerabilities/
URL Provider
Details Provider Source level domain
Details acunetix.com www.acunetix.com
Attributes
Details Type #Events CTI Value
Details Domain 831 
example.com
Details Domain 2 
bad.example.com
Details File 38 
secret.txt
Details File 3 
etree.xml
Details File 5 
xml.php
Details IPv4 142 
192.168.0.1
Details Url 4 
http://example.com/xml
Details Url 1 
http://192.168.0.1/secret.txt
Details Url 2 
http://bad.example.com/evil.dtd
Details Url 1 
http://example.com/xml.php