Tradecraft Security Weekly Subscribe

Dissecting XXE Attacks – Tradecraft Security Weekly #19

September 25, 2017

When pentesting web services or an application that leverage XML files, XML External Entity (XXE) attacks are a great way to start. By injecting an XXE into a well crafted XML payload before it's sent to the server, a penetration tester can trick the parser into executing other actions that the developer never intended. This can lead to reading local files, server-side request forgeries (SSRF) or even gaining remote code execution (RCE). To help penetration testers, Beau Bullock (@dafthack) and Mike Felch (@ustayready) cover a few different methods to attack XML parsers in episode 19 of Tradecraft Security Weekly. Links: https://www.owasp.org/index.php/XMLExternalEntity(XXE)PreventionCheatSheet

Full episode and show notes

Related

Speak the Same Language, as Cybersecurity is Everyone’s Responsibility – BSW #382

February 12, 2025

This week, we tackle a ton of leadership and communications articles: Why CISOs and Boards Must Speak the Same Language on Cybersecurity, The Hidden Costs of Not Having a Strong Cybersecurity Leader, Why Cybersecurity Is Everyone’s Responsibility, Leadership is an Action, not a Position, and more!

Vulnerability Management

PlayStation, KerioControl, SEC SimSWAP, 8base, Copilot, AI, Bird, Josh Marpet… – SWN #450

February 11, 2025

PlayStation, KerioControl, SEC SimSWAP, 8base, Copilot, AI, Robert Bird, Josh Marpet, and more on the Security Weekly News.

Application security

Unforgivable Vulns, DeepSeek iOS App Security Flaws, Memory Safety Standards – ASW #317

February 11, 2025

Identifying and eradicating unforgivable vulns, an unforgivable flaw (and a few others) in DeepSeek's iOS app, academics and industry looking to standardize principles and practices for memory safety, and more!