BiteSizedChunks.comLearn one small thing at a time.

Course contentsShow

562What is SQL Injection
563Classic SQL Injection Example
564SQL Query Structure and Injection Points
565In-Band SQL Injection Types
566Union-Based SQL Injection Technique
567Error-Based SQL Injection Exploitation
568Blind SQL Injection Fundamentals
569Boolean-Based Blind SQL Injection
570Time-Based Blind SQL Injection
571SQL Injection in Different Contexts
572Database Fingerprinting via SQL Injection
573SQL Injection Impact and Attack Scenarios
574Blind SQL Injection Fundamentals
575Boolean-Based Blind SQLi
576Time-Based Blind SQLi
577Out-of-Band SQL Injection
578Union-Based SQLi Data Extraction
579Error-Based SQLi Information Disclosure
580Stacked Queries and Multiple Statements
581Second-Order SQL Injection
582Database Fingerprinting Techniques
583Advanced Data Exfiltration Methods
584Privilege Escalation via SQL Injection
585File System and OS Command Execution
586SQLMap Fundamentals and Command-Line Basics
587SQLMap Detection and Fingerprinting Techniques
588SQLMap Data Extraction and Enumeration
589SQLMap Advanced Exploitation Features
590SQLMap Evasion and Tampering Scripts
591Burp Suite SQL Injection Scanner Extensions
592NoSQLMap and NoSQL Injection Automation
593Custom SQL Injection Automation Scripts
594NoSQL Database Fundamentals and Attack Surface
595MongoDB Injection Techniques
596JSON Injection and Type Confusion
597NoSQL Blind Injection and Timing Attacks
598NoSQL Injection in Different Database Types
599Server-Side JavaScript Injection
600NoSQL Injection Prevention and Input Validation
601Detecting and Testing for NoSQL Injection
602Command Injection Fundamentals
603Command Injection Attack Vectors
604Shell Metacharacters and Command Chaining
605Blind Command Injection Techniques
606Out-of-Band Data Exfiltration
607Command Injection in Different Shells
608Filter Bypass and Obfuscation
609Command Injection Prevention: Input Validation
610Safe Command Execution Practices
611Command Injection Testing and Detection
612LDAP Injection Fundamentals
613LDAP Injection Attack Techniques
614LDAP Injection Detection and Testing
615Preventing LDAP Injection
616XML Injection Fundamentals
617XML Injection Attack Vectors
618XML Injection Prevention
619XXE Fundamentals and XML Parsing
620XXE Attack Types: File Disclosure
621XXE Attack Types: SSRF via XXE
622Blind XXE Techniques
623XXE via File Upload and Content Types
624XInclude and Parameter Entity Attacks
625XXE Prevention: Parser Configuration
626XXE Defense in Depth
627Testing for XXE Vulnerabilities

562What is SQL Injection
563Classic SQL Injection Example
564SQL Query Structure and Injection Points
565In-Band SQL Injection Types
566Union-Based SQL Injection Technique
567Error-Based SQL Injection Exploitation
568Blind SQL Injection Fundamentals
569Boolean-Based Blind SQL Injection
570Time-Based Blind SQL Injection
571SQL Injection in Different Contexts
572Database Fingerprinting via SQL Injection
573SQL Injection Impact and Attack Scenarios
574Blind SQL Injection Fundamentals
575Boolean-Based Blind SQLi
576Time-Based Blind SQLi
577Out-of-Band SQL Injection
578Union-Based SQLi Data Extraction
579Error-Based SQLi Information Disclosure
580Stacked Queries and Multiple Statements
581Second-Order SQL Injection
582Database Fingerprinting Techniques
583Advanced Data Exfiltration Methods
584Privilege Escalation via SQL Injection
585File System and OS Command Execution
586SQLMap Fundamentals and Command-Line Basics
587SQLMap Detection and Fingerprinting Techniques
588SQLMap Data Extraction and Enumeration
589SQLMap Advanced Exploitation Features
590SQLMap Evasion and Tampering Scripts
591Burp Suite SQL Injection Scanner Extensions
592NoSQLMap and NoSQL Injection Automation
593Custom SQL Injection Automation Scripts
594NoSQL Database Fundamentals and Attack Surface
595MongoDB Injection Techniques
596JSON Injection and Type Confusion
597NoSQL Blind Injection and Timing Attacks
598NoSQL Injection in Different Database Types
599Server-Side JavaScript Injection
600NoSQL Injection Prevention and Input Validation
601Detecting and Testing for NoSQL Injection
602Command Injection Fundamentals
603Command Injection Attack Vectors
604Shell Metacharacters and Command Chaining
605Blind Command Injection Techniques
606Out-of-Band Data Exfiltration
607Command Injection in Different Shells
608Filter Bypass and Obfuscation
609Command Injection Prevention: Input Validation
610Safe Command Execution Practices
611Command Injection Testing and Detection
612LDAP Injection Fundamentals
613LDAP Injection Attack Techniques
614LDAP Injection Detection and Testing
615Preventing LDAP Injection
616XML Injection Fundamentals
617XML Injection Attack Vectors
618XML Injection Prevention
619XXE Fundamentals and XML Parsing
620XXE Attack Types: File Disclosure
621XXE Attack Types: SSRF via XXE
622Blind XXE Techniques
623XXE via File Upload and Content Types
624XInclude and Parameter Entity Attacks
625XXE Prevention: Parser Configuration
626XXE Defense in Depth
627Testing for XXE Vulnerabilities

Lesson 623 of 3,052·13. Web Security - Injection AttacksPro lesson

XXE via File Upload and Content Types

Identify XXE in file uploads, SVG processing, DOCX files, and other formats that embed XML.

This lesson is for subscribers

You've completed the free preview. Subscribe to unlock every lesson in every course.

See pricing Back to course