View
18
Download
0
Category
Preview:
Citation preview
Advanced XXE ExploitationExercise 2: External DTD (App port 8022)
Philippe ArteauGoSecure Countertack
19/06/2019Slides: http://bit.ly/xxeparis
Direct response from XXE
Not ideal In some case, you might have no response
Side-Channel XXE with external DTD
XML
Request DTD
Request FTP
XML payload
DTD host over HTTP
XML payload
FTP service
Edit FTP to have something unique
In real test, you should test using :- 443- 80- 21
1. Send XML payload
2. DTD is loaded!
3. FTP URL is evaluated!
Putting the pieces together
Using repeater efficiently with HackVertor
Using the fake FTP server interactivelly
Bonus:Try to get RCE on the server
QuestionS ?
Contactparteau@gosecure.cagosecure.net/blog/@h3xStream @GoSecure_Inc
Recommended