How to check XXE(XML External enitites) vulnerability using OWSAP

65 views Asked by At

I'm new to security testing, Could you please help me to how to find the Xml external entity using OWASP ZAP Mutillidea for learning

What steps should I take? I've reviewed the tutorials, but they haven't been helpful for me. Thank You

1

There are 1 answers

0
Simon Bennetts On

Launch a browser from ZAP, enter XML in that form and submit it. Then run the active scanner on the relevant request. Note that ZAP may only try XML attacks if it recognises that the request is really XML. Submiting XML via a form is not usual, and so not something that ZAP will do unless its obviously XML. A standard HTML POST will not obviously be XML.