How to search for XXE!

[@hackersguild8445]

You are an awesome teacher mate. This was the best explanation I have ever seen. Thanks a lot

[@intigriti]

You're very welcome! We are very glad you find it helpful! Thanks a lot from @hacksplained for your words!

[@SrankWrid]

Wuoy! Go to toilet if you will pee

[@SrankWrid]

Wuoy! Stick your hands out so I can see the bigger areas of you

[@bertrandfossung1216]

Awesome video. Thank you for breaking down XXE to the simplest level. Now I feel confident hunting them.

[@intigriti]

Thank you very much for your feedback! We are glad, we could help!

[@bloodmann264]

0:47 - Is it me or everyone noticed? When he said Burp, it actually sounded like he burped😂

[@intigriti]

😂

[@alirezaalavi8419]

LOL

[@nepaliwhitehat2150]

Thanks sir for upload helpful content in KZbin and lots of love from Nepal🇳🇵 and keep it up sir

[@intigriti]

So nice of you! Keep on hunting!

[@落珰]

谢谢您的讲解，受益匪浅

[@intigriti]

不客气

[@bloodmann264]

我不得不使用谷歌翻译，但是是的，他的视频很好。但他的“打嗝”这个词实际上听起来像是打了个饱嗝。

[@erroregrammaticale6877]

thanks for your job from Italy!

[@intigriti]

Our pleasure! 🥰

[@zeynepguner4348]

Great video! Thank you so much!

[@intigriti]

You are so welcome!

[@mnageh-bo1mm]

what if the request doesn't contain xml but the response does? i think i can control some of the output as it gets grabbed from another location

[@intigriti]

Ooooo interesting! I guess it would depend how it's processed, e.g. is the user input safely sanitised/processed and then the response is returned in JSON.. OR, if the input is inserted into XML, processed unsafely and then the output returned..

[@mnageh-bo1mm]

@@intigriti thanks will check and report back

[@mnageh-bo1mm]

@@intigriti so the request itself has a content type of application/x-www-form-urlencoded , while the response which contains the value of the submitted param is xml ... any clue with this weird mix?

[@ndog315]

Studying for PNPT, best explanation on how to search for xxe thus far. Thank you sir! You got another sub

[@intigriti]

Welcome aboard! Glad you enjoyed this one!

[@mrdzha9519]

thanx a lot!!!!!!

[@intigriti]

Very welcome! 💜

[@vikaskumar-pc1xd]

I need this one

[@intigriti]

There you go! :) Start searching for them 💪

[@itsm3dud39]

bro is xxe still prevalant?

[@intigriti]

It is! It's still ranked #5 in the current OWASP Top 10 - blog.intigriti.com/hackademy/xml-external-entity-processing-xxe/

[@itsm3dud39]

@@intigriti ok. but i see json most of the time instead of xml

[@0xRobiul]

1st! 😷

[@intigriti]

🏎