Add Testing for XML External Entity (XXE) Weaknesses

[itscooper]

No description provided.

[kingthorin]

XXE has a small section or two included in v4:
https://www.owasp.org/index.php/Testing_for_XML_Injection_(OTG-INPVAL-008)

[kingthorin]

Ref: https://twitter.com/PortSwigger/status/1133707942329552898
→ https://portswigger.net/web-security/xxe/

[vermava]

Hi Team, I will share the draft shortly on this.

Thank you
Vandana

[ThunderSon]

@vermava hello! I'd prefer that you tackle an issue at a time. Which one would you like to take care of first?

[RiieCco]

I can pick this one up, we already have a small lab for this, i will improve the write-up to be more worthy and have more detailed explanation. After that i can include it in the testing guide :-)

Lab is found here:
https://owasp-skf.gitbook.io/asvs-write-ups/kbid-6-xxe

[kingthorin]

@vermava any luck putting something together as you mentioned earlier?

[kingthorin]

@vermava any luck putting something together as you mentioned earlier?

[Hsiang-Chih]

There are blackbox & whitebox approaches to test the XXE.
For a large scale projects, it's recommended to do whitebox source review based on specific API.
Refer to my previous work XXE CheatSheet. Let me know if I can do any help to add any contents for the testing guide.

https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html

[github-actions]

Please comment if you are still working on this issue, as it has been inactive for 30 days. To give everyone a chance to contribute, we are releasing it to new contributors.

[kingthorin]

@vermava @RiieCco any news on this?

[DotDotSlashRepo]

@kingthorin I would like to work on this.

[kingthorin]

Go for it 👍

[github-actions]

Please comment if you are still working on this issue, as it has been inactive for 30 days. To give everyone a chance to contribute, we are releasing it to new contributors.

[github-actions]

Please comment if you are still working on this issue, as it has been inactive for 30 days. To give everyone a chance to contribute, we are releasing it to new contributors.

[kingthorin]

https://github.com/OWASP/wstg/blob/ede0735edb3ac674137f2176ae5ff96e3d134bcd/document/4-Web_Application_Security_Testing/07-Input_Validation_Testing/07-Testing_for_XML_Injection.md