Burp Suite User Forum

Create new post

How do i POC of XEE (XML external entity ) and Insecure Deserialization vulnerability

Sachin | Last updated: Mar 19, 2019 07:34AM UTC

How do i POC of XEE (XML external entity ) and Insecure Deserialization vulnerability

PortSwigger Agent | Last updated: Mar 19, 2019 10:25AM UTC

For XXE, the information on Wikipedia is quite helpful: - https://en.wikipedia.org/wiki/XML_external_entity_attack For insecure deserialization this depends very much on the language in use. There are are various tools, for example a Java tool is ysoserial: - https://github.com/frohoff/ysoserial Be aware the producing a working POC often involves considerable experimentation and tweaking.

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.