wstg
wstg copied to clipboard
OWASP
Add Testing for XML External Entity (XXE) Weaknesses
XXE has a small section or two included in v4: https://www.owasp.org/index.php/Testing_for_XML_Injection_(OTG-INPVAL-008)
Ref: https://twitter.com/PortSwigger/status/1133707942329552898 → https://portswigger.net/web-security/xxe/
@vermava hello! I'd prefer that you tackle an issue at a time. Which one would you like to take care of first?
I can pick this one up, we already have a small lab for this, i will improve the write-up to be more worthy and have more detailed explanation. After that i can include it in the testing guide :-)
Lab is found here: https://owasp-skf.gitbook.io/asvs-write-ups/kbid-6-xxe
There are blackbox & whitebox approaches to test the XXE. For a large scale projects, it's recommended to do whitebox source review based on specific API. Refer to my previous work XXE CheatSheet. Let me know if I can do any help to add any contents for the testing guide.
https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html
Please comment if you are still working on this issue, as it has been inactive for 30 days. To give everyone a chance to contribute, we are releasing it to new contributors.
![github-actions[bot] avatar](https://avatars.githubusercontent.com/in/15368?v=4 "Published by a pub.dev verified publisher"){kind=small}
Please comment if you are still working on this issue, as it has been inactive for 30 days. To give everyone a chance to contribute, we are releasing it to new contributors.
Please comment if you are still working on this issue, as it has been inactive for 30 days. To give everyone a chance to contribute, we are releasing it to new contributors.
https://github.com/OWASP/wstg/blob/ede0735edb3ac674137f2176ae5ff96e3d134bcd/document/4-Web_Application_Security_Testing/07-Input_Validation_Testing/07-Testing_for_XML_Injection.md