XML Vulnerabilities

Question 1

What is XML?

Answer 1

Extensive Markup Language

Note: It’s a set of codes or tags that defines rules for text in a digital document. It’s readable by both humans and machines. It was designed to store and transport data.

Question 2

What is XML used for?

Answer 2

It’s used by web apps for authentication, authorizations, and for data exchanging and uploading.

Question 3

How do you protect XML data?

Answer 3

XML data needs to be encrypted and/or with input validation.

Question 4

What attacks is XML vulnerable to?

Answer 4

Spoofing
Request forgery
Code injection

Question 5

What is an XML Bomb?

Answer 5

Known as the Billion Laughs Attack.

XML encodes entities that expand to exponential sizes consuming memory and potentially crashing the host.

Essentially this is a denial of service attack.

Question 6

What is an XML External Entity? (XXE)

Answer 6

An attack that embeds a request for a local resource.

Note: This is how file inclusion attacks occur.

Note: This can be prevented with input validation.

Question 7

Exam Note: If there is something with XML written in it, and it is clearly XML, it will be an XML vulnerability.

It may be called XML vulnerability, XML exploitation, XML injection.

Answer 7

HTML uses Keywords: Font, Image, Atrib

XML uses Keywords: Question, ID, Type, Entity