Hands-On Bug Hunting for Penetration Testers

Chapter 7

1. An example misconfiguration for an XML parser susceptible to XXE in PHP is not having the libxml_disable_entity_loader variable set to true to prevent entity expansion.
2. Using the Burp Proxy Intercept feature is key to submitting XML injection snippets.
3. XXE vulnerabilities can allow for an attacker to expose sensitive files on the server, DoS the application, or sometimes get RCE.
4. /dev/random is a special system location that acts as pseudorandom number generator.

5. Testing for XXE using simple entity subsitution is an easy, lightweight way of validating XXE bugs.
6. The "Billion Laughs" attack is not unique to XML; it is the use of nested entities to consume exponential memory and DoS the parsing service.
7. Even though some services ...