filmov
tv
Learning XXE with PortSwigger's Web Security Academy - Part 1
Показать описание
Additional References for Further Exploration:
------------------------------------------------------------------------------
In this series, we take a look at Web Security Academy's External Entity Injection lab and break it down. The goal is to break down the concepts to not only get to the solution, but talk about methodology and the mental steps we take in order to discover these vulnerabilities in the wild.
Lab 1: Exploiting XXE using external entities to retrieve files
Lab 2: Exploiting XXE to perform SSRF attacks
Lab 3: Blind XXE with out-of-band interaction
Lab 4: Blind XXE with out-of-band interaction via XML parameter entities
Lab 5: Exploiting blind XXE to exfiltrate data using a malicious external DTD
Timestamps:
0:00 Intro
0:27 Pre-Requisite XML Reference
0:43 What is XXE?
0:57 What are Local Entities?
1:28 How about External Entities?
2:43 Lab 1 In-Band Exploitation of XXE
4:55 Lab 2 Exploit XXE to Perform SSRF
6:53 Lab 3 Blind XXE - Out-of-Band Interaction
9:18 Lab 4 Parameter Entities
11:48 Lab 5 Out-of-Band Data Exfiltration
16:21 Out-of-Band Exfiltration Recap
17:55 Outro
------------------------------------------------------------------------------
Music:
“Ghosted”
Produced by Bankrupt Beats
“High Noon”
Produced by Bankrupt Beats
“Ikebaby”
Produced by Robotprins
0:18:52
Learning XXE with PortSwigger's Web Security Academy - Part 1
0:18:18
Learning XXE with PortSwigger's Web Security Academy - Part 2
0:07:53
XXE Practical Lab - Portswigger - Part 1
0:03:08
Testing for XXE injection vulnerabilities with Burp Suite
0:03:33
Exploiting XXE Using External Entities to Retrieve Files | PortSwigger Academy
0:02:30
Testing for blind XXE injection vulnerabilities with Burp Suite
0:07:38
XXE Lab03# Blind XXE with Out-of-Band Interaction - Web Security Academy
0:03:20
Exploiting XInclude to Retrieve Files via XXE | PortSwigger Academy
0:05:19
Web Application Hacking with Burp Suite - Finding and Exploiting XXE Vulnerabilities
0:09:31
XXE Lab01# Exploiting XXE using external entities to retrieve files - Web Security Academy
0:08:16
XXE Lab02# Exploiting XXE to perform SSRF attacks - Web Security Academy
0:09:37
Blind XXE and parameter entities with portswigger burp suite collaborator and labs
0:08:30
Web Security Academy | XXE | 6 - Exploiting Blind XXE to Retrieve Data via Error Messages
0:05:01
LAB:7 Blind XXE with out-of-band interaction via XML parameter entities || Portswigger || BSCP
0:03:32
Chaining XXE into SSRF: PortSwigger labs
0:09:16
Blind XXE Lab05# to exfiltrate data using a malicious external DTD - Web Security Academy
0:09:01
Portswigger XML injection:Exploiting blind XXE to exfiltrate data using a malicious external DTD #50
0:21:51
Web Security Academy | XXE | 5 - Blind XXE to Exfiltrate Data Using a Malicious External DTD
0:02:26
XXE Lab Breakdown: Exploiting XXE to perform SSRF attacks
0:04:32
Username enumeration via different responses | PortSwigger Web Security Academy | BurpSuite - 01
0:02:06
Blind XXE With Out-Of-Band Interaction | Web Security Academy | PortSwigger Labs | Owasp
0:02:46
Portswigger XML external entity (XXE) injection: Exploiting XXE via image file upload #53
0:05:31
XXE Injection 2 | Exploiting XXE to Perform SSRF Attacks #BugBounty
0:01:41
XXE : Blind out-of-band via XML parameter entitiesWebSecurity || BurpSuite || PortSwigger || 2020
Комментарии