Performing XXE attacks
In an XXE attack, the attacker sends XML input that includes a reference to an external entity to an application. The XML input causes the application to behave in a manner that it was not intended to. Successful exploitation of an XXE attack can lead to an attacker viewing the content of files, exfiltrating data, server-side request forgery (SSRF), and remote code executions.
Getting ready
This lab requires a PortSwigger Academy account and ZAP to be able to intercept requests and responses from the server to your browser.
How to do it...
In this lab, we will walk through performing an XXE attack to retrieve the contents of the passwd file. Please follow these instructions:
- Navigate to the URL with the browser proxied to ZAP and log into the PortSwigger Academy website to launch the lab. The lab we will work on in this section is Exploiting XXE Using External Entities to Retrieve Files. The link to the lab is accessed here: https://portswigger...
