Force syntax attack

Question

Studying xml vulnerabilities, I ran into a power syntax attack. can anyone say what constitutes a forced syntax attack (in SOA applications). How is the attack? How to implement this attack using XML parser in java?

Answer 1

For an example of this attack, see the Billion Laughs Attack section.

For a full discussion of attack, testing, and basic security features, see the "Webware Testing Cookbook" recipe for malicious XML. (Google’s free preview - just 3 pages). Exposure:

" XML XML- ... ".

:

http://www.ibm.com/developerworks/xml/library/x-tipcfsx.html

http://en.wikipedia.org/wiki/Billion_laughs

Answer 2

- XML-, XML-, , . , , , , . , .

, -.

Answer 3

(DTD) .
XML "CDATA", '<', '&'.
XML- . te cdata , , , .
, xpath.