This thread reminded me of a draft post I've been sitting on for a while, related to ENTITY tags in XML and XXE exploits. Basically, it's really easy to leave

This thread reminded me of a draft post I've been sitting on for a while, related to ENTITY tags in XML and XXE exploits. Basically, it's really easy to leave default XML parsing settings (for things like consuming RSS feeds) and accidentally open yourself up to reading files off the filesystem. I did a full write-up and POC here: http://mikeknoop.com/lxml-xxe-exploit http://mikeknoop.com/lxml-xxe-exploit