Collaborate Disseminate
I have asked this already on Stack Overflow, but got a suggestion to ask in this community too.
I’m working on implementing an XML encrypting / decrypting application in .NET with support for ECDH-ES because clients will use EC key pairs t… Continue reading Is XML Encryption 1.1 Key Agreement test cases decryption possible in .NET? [closed]
I’m quite new to XXE attacks so please bear with me, when I look at the different payloads to get a OOB XXE they all look like the following (external DTD) :
<!ENTITY % file SYSTEM "file:///etc/passwd">
<!ENTITY % eval &… Continue reading I’m not sure why the different XXE injection payloads follow a specific pattern
Currently, I’ve discovered an OOB XXE that allows me to include a .dtd file to extract a particular system file content, for instance, /sys/power/disk.
So my file.dtd is:
<!ENTITY % data SYSTEM "file:///sys/power/disk">
<… Continue reading XXE OOB File Content Extraction
Signing XML file with XAdES extension provides the X509 certificate.
What is the security point if the certificate is given? Anyone can tamper the data with its own certificate, right?
I used to work with certificate ids and have to reach … Continue reading How XAdES protects against tampering if the certificate is embedded?
For those of us who have spent entire careers working with structured data, it comes as something of a surprise to be reminded that XML is now 25 years old. …read more Continue reading XML Is A Quarter Century Old
I was able to extract a line from the /etc/hostname file and also http://169.254.169.254/latest/meta-data/local-hostname but I want to extract the content of files with multiple line, such as the aws credentials or /etc/passwd
I tried php… Continue reading Extracting multiple lines out of band XXE [closed]
I am trying to validate a xml certificate signed by a entity called Camerfirma, I had to download their DER file and convert it to PEM in order to place it into /etc/ssl/certs/ (with the other authorized CAs). To validate the certifcate I … Continue reading Trying to use xmlsec1 but doesn’t show the CAs used
I’m studying XXE vulnerabilities, and I don’t know much about XML.
Apparently for exfiltrating data from server, in the case that XXE vulnerability is blind, we need to make an external DTD like this:
<!ENTITY % file SYSTEM "file:/… Continue reading Why do we need three entities in external DTD for blind XXE?
If I am already using
xmlInputFactory.setProperty(XMLInputFactory.SUPPORT_DTD, false);
then do I also need to use
xmlInputFactory.setProperty("javax.xml.stream.isSupportingExternalEntities", false);
to fix an XXE vulnerability?… Continue reading Java XXE vulnerability
Could someone DNS spoof REST API communication between a client device POST to a server URL running a XML-based API on HTTPS?
If a man-in-the-middle for client device(s) POSTing to the server on a scheduled frequency where all REST API com… Continue reading DNS spoofing an API? [duplicate]