A simple XXE example

There are a few different types of XXE attack which can attempt Remote Code Execution (RCE) or – as we covered in the introduction – disclose information from targeted files. Here's an example of the second variety, from OWASP's entry for XXE:

 <?xml version="1.0" encoding="ISO-8859-1"?>
 <!DOCTYPE foo [  
   <!ELEMENT foo ANY >
   <!ENTITY xxe SYSTEM "file:///etc/passwd" >]><foo>&xxe;</foo>

Here, you can see the external entity and its attempt—through the location string's file prefix and the following system path—to access a sensitive file on the vulnerable server.

XXE can also be used to conduct DoS attacks through an XML variant of a popular logic bomb tactic called a Billion Laughs. A DoS attack that occurs via a logic bomb—a piece of...