XML External Entity (XXE) Injection Courses and Certifications

CryptoCat

XML External Entity Injection (XXE) - Exploiting Web Application Vulnerabilities - Episode 3

Master XML External Entity Injection techniques through hands-on exploitation of Portswigger's Gin and Juice shop, covering file retrieval, SSRF attacks, and blind XXE data exfiltration methods.

• YouTube
• 13 minutes
• On-Demand
• Free Video

Uncle Rat's XXE Handbook

160 ratings at Udemy

Comprehensive guide to XXE vulnerabilities: learn detection, exploitation, evasion techniques, and prevention methods through practical demonstrations and detailed explanations.

• Udemy
• 1 hour 6 minutes
• On-Demand
• Free Online Course

OWASP Top 10: #3 Sensitive Data Exposure and #4 External Entities (XXE)

131 ratings at LinkedIn Learning

Get an overview of the #3 and #4 top software vulnerabilities—injection and insecure design—described in the 2021 OWASP Top 10.

• LinkedIn Learning
• 32 minutes
• On-Demand
• Free Trial Available

Learn to identify, exploit, and protect against XML External Entities (XXE) vulnerabilities. Gain hands-on experience through demos and labs, focusing on real-world scenarios like the Facebook XXE vulnerability.

• Cybrary
• 2-3 hours
• On-Demand
• Paid Course

Bugcrowd

XML External Entity Injection

Learn to identify, exploit, and mitigate XML External Entity (XXE) vulnerabilities. Gain practical skills to enhance application security and protect against data disclosure and system impacts.

• YouTube
• 19 minutes
• On-Demand
• Free Video

Cyber Mentor

Web App Testing - XXE, Input Validation, Broken Access Control, and More XSS

Explore advanced web app testing techniques including XXE, input validation, broken access control, and XSS. Enhance your ethical hacking skills and learn to identify critical vulnerabilities.

• YouTube
• 1 hour 57 minutes
• On-Demand
• Free Video

How to Avoid Writing Insecure Code

1783 ratings at Udemy

Best ways to prevent coding mistakes that hackers abuse

• Udemy
• 6 hours 16 minutes
• On-Demand
• Paid Course

Hacking REST APIs - A beginner's guide

1111 ratings at Udemy

Practical guide to pentesting REST APIs from scratch

• Udemy
• 1 hour 8 minutes
• On-Demand
• Paid Course

Black Hat

Exploiting XXE Vulnerabilities in File Parsing Functionality

Techniques for exploiting XXE vulnerabilities in file parsing, focusing on XML-supported formats like docx and xlsx. Includes real-world examples and introduces a tool for creating 'XXE backdoored' files.

• YouTube
• 22 minutes
• On-Demand
• Conference Talk

NahamSec

Finding 0days in Enterprise Web Applications

Explore techniques for finding 0-day vulnerabilities in enterprise web applications, focusing on HCL Digital Experience, Solarwinds Web Help Desk, and Sitecore's Experience Platform.

• YouTube
• 35 minutes
• On-Demand
• Conference Talk

Black Hat

FileCry - The New Age of XXE

Explore critical XXE vulnerabilities in enterprise software, including 0-day exploits in Java and Internet Explorer. Learn detection, exploitation, and prevention techniques.

• YouTube
• 33 minutes
• On-Demand
• Conference Talk

44CON Information Security Conference

Hunting Asynchronous Vulnerabilities

Explore techniques for uncovering hidden vulnerabilities in backend systems using exploit-induced callbacks. Learn to detect and exploit asynchronous issues across various technologies and platforms.

• YouTube
• 33 minutes
• On-Demand
• Conference Talk

nullcon

Finding 0-Days in PHP Apps with Coverage-guided Fuzzing - What The PHUZZ?!

Discover how PHUZZ, an open-source prototype, enables coverage-guided fuzz testing for PHP web applications, outperforming popular scanners in detecting vulnerabilities and uncovering CVEs in WordPress plugins.

• YouTube
• 38 minutes
• On-Demand
• Free Video

nullcon

Project Dusseldorf: Finding Out-Of-Band Vulnerabilities At Cloud Scale

Discover Project Dusseldorf, a versatile out-of-band appsec platform used by Microsoft teams to detect vulnerabilities like SSRF, XXE, SSTI, XSS, and RCE at cloud scale, now being open-sourced.

• YouTube
• 39 minutes
• On-Demand
• Free Video