Summary

In this chapter, we covered XXE and touched on the nature of XML parsing attacks, discussed XXE within the historical context of the Billion Laughs vulnerability, reviewed a specific weakness that makes many XML parsers vulnerable to XXE, and end-gamed some of the possible attack scenarios associated with an XXE bug, in addition to taking an XXE vulnerability all the way from discovery to report submission.

In the next chapter, we will discuss access control and security through obscurity.