How XML processing leads to security issues: unpacking XXE
summary
Explains how XML processing can cause security issues, focusing on XML External Entity (XXE) vulnerabilities in Java contexts. Describes why XML handling leads to security defects, categorizes types of XXE, shows their attack mechanisms and defenses, and illustrates with real open-source vulnerability examples.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 3:14What is XXE and why it's dangerous
- 8:12Malicious XML components
- 12:56XXE without parsing results
- 18:16Protecting against XXE in Java
- 22:46Dangerous vs safe XML parsers
- 27:23Real-world XXE examples
- 34:30XXE in XML-based formats
- 37:21How to defend against XXE
- 42:05Tools for finding XXE
- 44:57Summary and recommendations
related talks
39mWhat You Didn't Know About XML External Entities Attacks
33mSecurity is Broken: Understanding Common Vulnerabilities
49mThe Anatomy of Java Vulnerabilities
44mSelected Vulnerabilities in Web Applications
56mThe Anatomy of Java Vulnerabilities
50mModern WebApp Vulnerabilities
31mHow to Protect Yourself Against XSS Attacks in Java
46mThe Anatomy of Java Vulnerabilities