Books for you

A little known ???feature??? of XML is external entities, whereby developers can define
their own XML entities. For example, this sample XML-based Really Simple Syndication
(RSS) document defines the &author; entity and uses it throughout the page:


]>
&author;
You can also define entities that read system files. For example, when an XML parser
reads the following RSS document, the parser will replace &passwd; or &passwd2;
with /etc/passwd:



]>



this is file:/etc/passwd: &passwd; and this is
ile:///etc/passwd: &passwd;
14 Hacking Exposed Web 2.0


file:/etc/passwd: &passwd; file:///etc/passwd:
passwd;
http://example.com



To exploit this attack, the attacker simply places this RSS file on his or her web site
and adds this attack RSS feed to some online RSS aggregator.


Pages:
52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76