I'm trying to reproduce several xxe attacks against a java web service.
When i try to reproduce "Billion Laughs" i always get this:
Exception in thread "main" org.xml.sax.SAXParseException; lineNumber: 1; columnNumber: 1; The parser has encountered more than "64,000" entity expansions in this document; this is the limit imposed by the application.
I've tried:
oracle jdk1.7.0, oracle jdk1.7.0_51, oracle jdk1.7.0_55,
All of them are throwing the same exception, and according to this, versions _51 and _55 shouldn't
Am i missing something ?
Edit:
Works when i use "-DentityExpansionLimit=0", of course. But i need an "unpatched" jdk.