XXE and insecure deserialization: not trusting the parser blindly
You recognise in code and traffic how XML entities and object serialization turn into flaws, configure parsers safely language by language, move to safe data formats and hunt for attack traces in the logs.
Level 301 · 17 lessons · 15 practice labs
Lessons
XML and XXE
- XML entities and DTDs: how a feature becomes a flaw
- Where XXE hides: SOAP, SVG, Office files and SAML
- Blind XXE and parameter entities
- Billion laughs and documents that exhaust the parser
- Short task: evidence the XXE in an SVG upload feature
Processing XML safely
- Parser settings language by language: Java, .NET, PHP and Python
- Spotting XXE traces in logs and outbound traffic
- Short task: configure the parser safely in three languages and retest
Serialization
- What serialization is: from object to bytes and back
- How insecure deserialization happens: building objects from untrusted data
- The gadget chain concept: harmless classes in a dangerous combination
- Risky formats by language: Java, PHP, Python pickle, .NET and Node
- Recognising serialized data in traffic
- Short task: find a serialized object carried in a cookie and explain its risk
Fixing and detecting
- Safe options: JSON, schemas, signatures and type allow-lists
- Spotting deserialization attacks in application and process logs
- Capstone: close the XXE and deserialization flaws in a document-processing service
Practice labs
- XXE in an SVG upload: Prove the SVG upload feature resolves external entities by making it read a harmless file in the lab.
- XXE in a SOAP endpoint: Prove an old SOAP endpoint processes DTDs and fix the parser setting.
- The XML inside an Office document: Show the document import feature parses the XML parts of an Office file unsafely and harden the parser.
- A parser exhausted by billion laughs: Measure in the lab how nested entity expansion slows the service, turn off entity expansion and add a size limit.
- Safe XML parsing in Python: Replace the unsafe parser in the Python service with a safe library and test the old flaw is closed.
- DocumentBuilderFactory settings in Java: Configure the XML factory in the Java service with safe features and verify with a unit test.
- An XXE trace in outbound traffic: Find the parser's unexpected outbound requests in the egress log and match the upload that triggered them.
- Blind XXE: parameter entities: Confirm blind XXE on an XML endpoint that returns nothing with the lab request catcher and review the parsers in every language.
- Recognise the serialised object in a cookie: Identify from its bytes which language and format a session cookie is serialised in and explain the risk.
- An object tampered with through PHP unserialize: Prove the PHP object in the basket cookie can be changed and is accepted and switch to JSON with a signature.
- A type allow list with Java ObjectInputStream: Find the place in the Java service that builds objects from untrusted data and apply a type allow-list filter.
- A job queue that uses Python pickle: Show with harmless proof that pickle data can enter the job queue from outside and move the queue to signed JSON.
- A deserialisation attack in the process log: Find a deserialisation error followed by an unexpected child process in app and process logs and lay it out on a timeline.
- Two flaws in a document processing service: Close XXE and unsafe deserialisation in the fictional Brivex Docs service, write a detection rule for each and retest.
- Hunting serialised data in traffic: Write a search that finds parameters carrying Java, .NET and PHP serialisation signatures in lab traffic and prioritise the results.
About this course
You recognise in code and traffic how XML entities and object serialization turn into flaws, configure parsers safely language by language, move to safe data formats and hunt for attack traces in the logs.
What you will learn
- XML and XXE
- Processing XML safely
- Serialization
- Fixing and detecting
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run on your own Kali Linux desktop in the browser, with the tools ready in their windowed interfaces. Nothing to install; a computer screen is recommended.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.