Question

XML external entity attacks ( XXEs) are fascinating vulnerabilities that target the XML parsers of an application. XXEs can be very impactful bugs, as they can lead to confidential information disclosure, SSRFs, and DoS attacks. But they are also difficult to understand and exploit.

XML 外部实体攻击 (XXE) 是一种针对应用程序的 XML 解析器的迷人漏洞。 XXE 可能是非常具有影响力的漏洞，因为它们可能导致机密信息泄露、SSRF 和 DoS 攻击。但是它们也很难理解和利用。

In this chapter, we’ll dive into the ins and outs of XXEs so you can find one in the wild. We will also talk about how to use XXEs to extract sensitive files on the target system, launch SSRFs, and trigger DoS attacks.

在本章中，我们将深入探讨 XXE 的各个方面，以便您能够在野外找到其中一个。我们还将讨论如何使用 XXE 提取目标系统上的敏感文件，启动 SSRF 并触发 DoS 攻击。