xsl – WindowsTechs.com

[SANS ISC] New Example of XSL Script Processing aka “Mitre T1220”

Posted on February 2, 2021 by Xavier

I published the following diary on isc.sans.edu: “New Example of XSL Script Processing aka ‘Mitre T1220‘”: Last week, Brad posted a diary about TA551. A few days later, one of our readers submitted another sample belonging to the same campaign. Brad had a look at the traffic so I decided

The post [SANS ISC] New Example of XSL Script Processing aka “Mitre T1220” appeared first on /dev/random.

Continue reading [SANS ISC] New Example of XSL Script Processing aka “Mitre T1220”→

CWE-611: Improper Restriction of XML External Entity Reference with XSL include

Posted on August 23, 2019 by Hoppe

Veracode reports that the below code is susceptible to CWE-611: Improper Restriction of XML External Entity Reference.

XslCompiledTransform transform = new XslCompiledTransform();
transform.Load(xslwithospath);
StringWriter … Continue reading CWE-611: Improper Restriction of XML External Entity Reference with XSL include→

Execute a PHP function that returns an array from an XSL file

Posted on October 5, 2017 by Sidahmed

There is a security challenge where you have to execute code on the server to retrieve a flag, and this code has to be executed using an XSL document.

So I found a way to make the server interpret my own XSL file, And I used… Continue reading Execute a PHP function that returns an array from an XSL file→

Are browsers fetching the XSLT namespace over HTTP when transforming XML?

Posted on July 1, 2016 by Eleron

According to the W3C recommendation (and according to W3C Schools), an XSL style sheet using XSLT should be declared as follows:

<xsl:stylesheet version=”1.0″ xmlns:xsl=”http://www.w3.org/1999/XSL/Transform”>

Question:
Is http:… Continue reading Are browsers fetching the XSLT namespace over HTTP when transforming XML?→