Web App Hacking: Hacking XML Processing
|
This course helps to understand different types of vulnerabilities in XML processing. You’ll learn how to test web applications for various XML processing flaws and how to provide countermeasures for these problems.
XML processing is widely used in modern web applications. This course, Web App Hacking: Hacking XML Processing, will teach you how to avoid the severe consequences of insecure XML processing. First, you’ll learn how the attacker can read the content of sensitive files from the web server with an XML External Entity attack (XXE). Next, you’ll discover how the attacker can steal the SecretAccessKey of the application hosted on Amazon Web Services as a result of an XXE attack. Then, you’ll see how the attacker can get a discount in an online store as a result of an XPath injection. After that, you’ll cover how the attacker can steal a user’s password as a result of an XSS attack via XML. Finally, you’ll explore how the attacker can upload an XML-based image (SVG) and steal some sensitive data from a user as a result of an XSS attack via SVG. By the end of the course, you’ll know how to test web applications for various XML processing flaws and how to provide countermeasures for these problems.
Author Name: Dawid Czagan
Author Description:
Dawid Czagan is listed among the Top 10 Hackers by HackerOne. He has found security vulnerabilities in Google, Yahoo, Mozilla, Microsoft, Twitter, and other companies. Due to the severity of these bugs, he has received numerous awards for his findings. He has delivered security training courses at key industry conferences, such as Hack In The Box, CanSecWest, 44CON, Hack In Paris, DeepSec, BruCON, and for many corporate clients. His students include security specialists from Oracle, Adobe, Red H… more
Table of Contents
- Course Overview
2mins - Introduction
5mins - XXE Attack
8mins - Going Deeper into an XXE Attack
7mins - XPath Injection
8mins - XSS via XML
7mins - XSS via SVG
7mins - Summary
3mins
User Reviews
Be the first to review “Web App Hacking: Hacking XML Processing”
Related Products
Scan Web Applications with Bash
Enumerating web applications is the first step of a web application penetration testing. This course will teach you how to enumerate and find vulnerabilities in web applications using Bash.
Red Team Operations: Target and Capability Development
Hey Humans! Come join us for an exciting adventure and Red Team Operation! In this course, we will be discussing the scenario and how to set up infrastructure and planning for your operation.
Defense Evasion with Meterpreter
Learning Defense Evasion is a prerequisite for using Metasploit tooling successfully in a secure environment. This course will teach you how to stay under the radar and evade detection even in highly secure environments.
Exploitation with Kali Linux
Kali contains an array of tools to assist with security assessments and penetration tests. This course will teach you how to use some of those tools to exploit the systems you find, moving you into a position to perform post exploitation tasks.
Post Exploitation with Meterpreter
In a penetration test, escalating your privileges and exfiltrating data are some of the most important tasks of the assessment. This course will teach you how to use the Meterpreter tool for post-exploitation tasks.
Active Defense with PowerShell
Attackers are constantly trying to get on your system, in your networks, and around your data. This course will teach you a few functions and scripts that can be utilized to proactively defend a system on a network.
There are no reviews yet.