Question: when studying about xml vulnerabilities , i came accross coercive parsing attack.
can anybody say what exactly is Coercive parsing attack(in SOA applications). How does the attack take place? How can one implement this attack using xml parser in java?

Answer: 
For an example implementation of this attack, see the "Billion Laughs Attack."

For a full discussion of the attack, how to test for it, and basic defenses, see the ["Web Security Testing Cookbook" recipe on Malicious XML.](http://books.google.com/books?id=VmrSJ3V-s_MC&lpg=PT116&dq=web%20security%20testing%20cookbook%20billion%20laughs&pg=PT116#v=onepage&q=web%20security%20testing%20cookbook%20billion%20laughs&f=false) (Free Google Preview - it's only 3 pages). An excerpt:

"This billion laughs attack abuses the tendency of many XML parsers to keep the entire structure of the XML document in memory as it is parsed ... enough to exhaust a vulnerable program's available memory."

Here's a few other resources:

<http://www.ibm.com/developerworks/xml/library/x-tipcfsx.html>

<http://en.wikipedia.org/wiki/Billion_laughs>
Because web services need to consume messages and XML documents it is possible to create XML documents which may strain the consuming systems as they try to validate and route it. Send enough of those documents at once and the consuming system may use up all its resources trying to work out if the messages are good or not and reject valid messages. Usually you do it by constructing a message with an insanely deep nesting structure, or even recursive nesting.

You'll implement it by constructing such a document and sending it off to the web service.