For those using the Java stack we have found HP's Fortify static analysis tool h... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

nradov on Jan 23, 2014 | parent | context | favorite | on: How I found a Remote Code Execution bug affecting ...

For those using the Java stack we have found HP's Fortify static analysis tool helpful in automatically detecting XXE vulnerabilities.

http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Q2-20...

billyhoffman on Jan 23, 2014 [–]

HP's WebInspect, a blackbox testing tool, also can find XXE's. However, as the OP shows, XXE's can be tricky and involve a lot of nuance to cox them out. General dynamic testing tools aren't as good at uncovering XXE's as static analysis tools.

Disclaimer: I used to work on WebInspect's audit engines

Consider applying for YC's Winter 2027 batch! Applications are open till November 2.
Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact