Hacking websites (great demos) with XML External Entities (XXE)

David Bumble hosts Tiberius, a well-known web app pentester and content creator, to discuss and demonstrate XML External Entities (XXE) vulnerabilities. Tiberius explains the basics of XXE, its potential risks such as server-side request forgery (SSRF) and file inclusion, and shares practical demonstrations including error-based and out-of-band XXE exploitation. The session also covers the use of Dynamic DTD for easier exploitation and the importance of proper XML parser configuration to mitigate these vulnerabilities. Links to Tiberius's YouTube channel and GitHub repository are provided for further learning and tool access.