Learning security in the open :)
I’m a Penetration tester. I write up each topic as I learn it
the Vulnerabilities, the Tools, the Concepts that finally clicked
latest Exploiting XXE to retrieve data by repurposing a local DTD
- 111writeups
- 110boxes rooted
- 5Certification
Latest writeups
All writeups-
Medium
Exploiting XXE to retrieve data by repurposing a local DTD
error based xxe on a server that blocks outbound connections, so instead of hosting a dtd you borrow the gnome docbookx.dtd already on disk and redefine its ISOamso entity to read /etc/passwd and leak it through the parser error
XML external entity (XXE) 4 min -
Medium
Exploiting XXE via image file upload
xxe smuggled in through an avatar upload
XML external entity (XXE) 3 min -
Easy
Exploiting XInclude to retrieve files
xxe where you only control one value inside the server's own xml document
XML external entity (XXE) 2 min -
Medium
Exploiting blind XXE to retrieve data via error messages
blind xxe with no visible output, pulled back through the parser's own error messages by wedging /etc/passwd into a broken file path
XML external entity (XXE) 3 min -
Medium
Exploiting blind XXE to exfiltrate data using a malicious external DTD
blind xxe where nothing is echoed back, so a hosted malicious external dtd nests parameter entities to read /etc/hostname and smuggle it out in the query string of a request to burp collaborator
XML external entity (XXE) 5 min -
Easy
Blind XXE with out-of-band interaction via XML parameter entities
blind xxe where regular external entities are filtered out
XML external entity (XXE) 3 min -
Medium
Blind XXE with out-of-band interaction
blind xxe where the parsed result is never shown, detected out of band by pointing an external entity at a burp collaborator subdomain so the parser fires a dns lookup and http request we can watch
XML external entity (XXE) 4 min