XML (Extensible Markup Language) is a set of rules for encoding documents in both human-readable and machine-readable form. It is defined in the XML 1.0 Specification produced by the W3C, and several other related specifications, all gratis open standards.

learn more… | top users | synonyms

1
vote
1answer
38 views

decrypt a soap message using openssl

I've tried to do the same as found in How to you manually decrypt a SOAP message using openssl? Unfortunatly without success... Here is my situation : I'm trying to do the same stuff only my data ...
0
votes
1answer
68 views

Java org.xmlpull.v1.XmlPullParser and XML External Entity (XXE) Processing Attacks

I'm evaluating the security of an Android application and the application is using the XmlPullParser included with Android. I'm having some difficulty getting any common attacks to work, but I want ...
0
votes
0answers
14 views

Does this show the proper results for signing an XML file

I did the following use this (sign) and this (verify) example on MSDN. Here are the results of all this (don't worry, I will delete the below key and generate new keys, on a different system); XML ...
0
votes
0answers
32 views

security issues with OOXML of POI

I read the announcement today related to security issues with OOXML. These issues are fixed as part of 3.10.1 version (issue : CVE-2014-3574 and CVE-2014-3529). However it does not list which all ...
3
votes
2answers
226 views

Is there a need to have XSS filters when I'm saving data as XML?

My web-app takes some configs from the user and saves into an XML file (it was not done to stop XSS). The input is XML encoded so that the ",& ... and such characters don't break the XML ...
0
votes
2answers
79 views

Can a static (HTML only) site be vulnerable to XXE?

First of all sorry if I am asking a trivial question. As far as I know, XML is used for representing document structures. Can entirely static sites accepting no user inputs at all be vulnerable to ...
1
vote
2answers
122 views

Is php DOMDocument::loadXML completely secure?

Our application is using loadXML extensively to recieve data(input) from the users. Other than the usual checks for SQL injections and XXS, are there any known risks in parsing the xml file using ...
1
vote
1answer
160 views

How to prevent XSS when transferring web page content within XML

I have an ASP.NET web application which uses HTTPS and XML based request-response. It seems a user's session cookie can be retrieved via XSS, if the request/response is intercepted and malicious ...
2
votes
1answer
92 views

/WEB-INF/web.xml showing MySQL credentials?

I found the file /WEB-INF/web.xml on a domain I'm associated with. The XML file contains: <database> <jndi-name>jdbc/mysql</jndi-name> <driver> ...
3
votes
1answer
77 views

Can XML attributes be exploited?

on my website i deliver an xml, whereas GET parameters will be added as (entityencoded) attributes somewhere in the xml. stripped down example: http://host/file.xml?x=y leads to <root> ...
0
votes
1answer
196 views

Understanding WS-Security and XML-Enc parts of a SOAP Request

I'm attempting to build a SOAP client to consume the services provided by eMedNy. They've provided me with a client X.509 certificate along with their server X.509 certificate. Their user guide ...
1
vote
2answers
576 views

XXE and its impact

I am trying to understand the concept behind XXE (XML External Entity injection). I went through OWASP Guidelines on XXE And since I am new to XML and DTD, I went through the W3Cschools tutorials as ...
2
votes
2answers
324 views

Exploiting flash XSS holes

I have a URL to a flash file. Sample :- http://abc.mydomain.com/Findme.swf Now, there is a parameter called xmlpath as :- http://abc.mydomain.com/Findme.swf?xmlPath=something. Is it not that ...
4
votes
2answers
490 views

Is XML encryption actually broken?

I recently stumbled on this post: XML Encryption Broken, Need To Fix W3C Standard I was expecting to find lots of information online about it, but there isn't actually all that much detail. Since I'm ...
0
votes
1answer
161 views

How does DOCTYPE selection affect security of my AJAX app?

I'm considering using modern techniques to protect my Javascript code and am studying how the DOCTYPE element selection may impact that. Specifically, the linked question used IFrames which are not ...
5
votes
1answer
3k views

How can XML Injection be exploited , need example?

So I found this explanation for a vulnerability on some cms : The XML parser at /WorkArea/Blogs/xmlrpc.aspx is vulnerable to XML external entity attacks which can be used to Scan behind ...
1
vote
1answer
1k views

How does a developer interact with Microsoft Certificate *Web Services*

Microsoft Certificate Web Services is a HTTPS web service (WS-Trust) that has no Kerberos dependency and can be used on a variety of devices. This is new in Windows 2008 and is separate from the ...
6
votes
2answers
443 views

Does anyone use XML Encryption?

The XML standard defines a mechanism for encrypting the data in a XML document. It's part of the standard. Does anyone use this XML encryption format? Are there any significant deployed systems ...
0
votes
1answer
1k views

How do I change the certificate of a Shibboleth service provider?

How do I change the certificate of a Shibboleth service provider? I have an existing identity provider (IDP) and service provider (SP) and I need to replace the certificate with a Verisign signed ...
7
votes
3answers
377 views

How do I test and secure ASN.1 Parsers?

As far as I can tell, .NET doesn't have an ASN.1 parser for reading or writing data built in the framework. This means that any code that creates or verifies ASN.1 data is using a 3rd party library ...
1
vote
1answer
172 views

Does an exposed XMLRPC API in a web application pose a threat?

I'm given the assignment of testing one of our web-servers in regards to security. One of the servers run IIS 7 and its application relies extensively on XMLRPC calls. I found the API for those calls ...
10
votes
1answer
432 views

Public XSLT & XML playground (with PHP DOMDocument, etc.) Security Risks?

Let's say I want to set up a sandbox or playground in PHP that users can use to create (or paste in) XML and XSLT, then transform the XML via the XSLT (by means of PHP 5's DOMDocument and related ...
0
votes
1answer
154 views

Does using many XML parsers (XDocument, XMLDocument) from the public Internet increase attack surface area?

I am coding an anonymous WCF service that allows others to post XML into it. Does using different kinds of XML parsers XDocument, XMLDocument, or even 3rd party parsers increase the attack surface ...
-1
votes
2answers
427 views

What can one define as quality criteria for an XML Schema?

One of the usage of Input validation, is to be protect against XSS. In case one would need to define best practice for the functions validating the input, then some (which I am calling quality ...
2
votes
2answers
207 views

Is WCF or Java Metro security configuration in-scope for your security department; should it be?

Windows Communication Foundation (WCF) is a set of technologies that expose server-side executable code and data over the Internet. Given the port sharing abilities of IIS, or even that a web ...
10
votes
3answers
832 views

If an XML document is not validated as “Well Formed” or checked against a schema, what are the risks?

When processing an XML document in my application, what are the risks? E.g. if it is not "Well Formed" or is not checked against a schema.