How to use XXE to your Advantage

Leo Pate (@ltpate3) In 2017, XML External Entities (XXE) saw its first appearance on the OWASP top 10 at number four. It has taken 5+ years for organizations (and L33T hackers) to realize how important (and simple) it is to exploit XXE vulnerabilities. This talk will focus on teaching the ins and outs of XXE, the unveiling of a custom tool, and how Blue, Red, and Purple teams can use our tool, and XXE, as an advantage in their organizations.