Thread by @Steiner254

Day 1⃣8⃣/2⃣0⃣ -- [XXE - XML External Entity]
➡️ XXE - is an application-layer cybersecurity attack that exploits an XXE vulnerability to parse XML input
➡️ Below some of the best Tips & References for XXE (Feel Free To Share)
🧵🧵👇👇
#BugBounty
#bugbountytip

1/n
XML external entity (XXE) injection
portswigger.net/web-security/x…

2/n
XML External Entity (XXE) Processing
owasp.org/www-community/…

3/n
What Is an XXE (XML External Entity) Vulnerability?
hackerone.com/knowledge-cent…

4/n
XXE Attack: Real life attacks and code examples
brightsec.com/blog/xxe-attac…

5/n
XML External Entity (XXE) Vulnerabilities and How to Fix Them
brightsec.com/blog/xxe-vulne…

6/n
XML external entity injection
learn.snyk.io/lessons/xxe/ja…

7/n
How to Execute an XML External Entity Injection (XXE)
cobalt.io/blog/how-to-ex…

8/n
Exploiting XXE Vulnerabilities In File Parsing Functionality

9/n
FileCry - The New Age Of XXE

10/n
XXE Lab Breakdown: Exploiting XXE using external entities to retrieve files

11/n
XXE Lab Breakdown: Exploiting XXE to perform SSRF attacks

12/n
XXE Lab Breakdown: Blind XXE with out-of-band interaction

13/n
Exploiting XXE for SSRF
gupta-bless.medium.com/exploiting-xxe…

14/n
A $7.500 BUG BOUNTY Bug explained, step by step. (BLIND XXE OOB over DNS) - REDUX by @stokfredrik

15/n
XXE Lab Breakdown: Exploiting XXE to retrieve data by repurposing a local DTD

16/n
XXE Lab Breakdown: Exploiting XXE via image file upload

17/n
XXE Lab Breakdown: Exploiting XInclude to retrieve files

18/n
XXE Lab Breakdown: Exploiting blind XXE to retrieve data via error messages

19/n
XXE Lab Breakdown: Exploiting blind XXE to exfiltrate data using a malicious external DTD

n/n
Practice Makes Perfect!
Stay Ethical & Happy Hacking :)
See you here same time tomorrow!