October 2024
Intermediate to advanced
330 pages
8h 53m
Spanish
Content preview from Seguridad de las aplicaciones web
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.
Capítulo 12. Entidad externa XML (XXE)
Este trabajo se ha traducido utilizando IA. Agradecemos tus opiniones y comentarios: translation-feedback@oreilly.com
XML External Entity (XXE) es una clasificación de ataque que suele ser muy sencilla de ejecutar, pero con resultados devastadores. Esta clasificación de ataque se basa en un analizador XML mal configurado dentro del código de una aplicación.
En general, casi todas las vulnerabilidades de ataque XXE se encuentran como resultado de un punto final de API que acepta una carga útil XML (o similar a XML). Puede que pienses que los puntos finales HTTP que aceptan XML son poco comunes, pero los formatos similares a XML incluyen SVG, HTML/DOM, PDF (XFDF) y RTF. Estos formatos similares a XML comparten muchas similitudes con la especificación XML y, como resultado, muchos analizadores XML también los aceptan como entradas.
La magia detrás de un ataque XXE es que la especificación XML incluye una anotación especial para importar archivos externos. Esta directiva especial de, denominada entidad externa, se interpreta en la máquina en la que se evalúa el archivo XML. Esto significa que una carga útil XML especialmente diseñada enviada al analizador XML de un servidor podría comprometer archivos de la estructura de archivos de ese servidor.
XXE se utiliza a menudo para comprometer archivos de otros usuarios, o para acceder a archivos como /etc/shadow que almacenan credenciales importantes necesarias para que un servidor basado en Unix funcione ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access
More than 5,000 organizations count on O’Reilly
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.Julian F.
I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.Addison B.
I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.Amir M.
I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.