[Hooded Robin]

You can use, html entity encoding to send in special characters or chars that are normally xml control characters (i.e. ">< => '&quot;&gt;&lt;)

[Gee4rce]

Nice HQ Tutorial mate : ) !!
I knew XXE but still learnt a thing from this, thank you Benzi!!
Greets, Gee.

[SIM-2198759]

Thanks for this dude, very useful!
Ill research this some more!

[Root_x7]

Thanks for this awesome tutorial benzi bro

[Root_x7]

Awesome Tutorial Thanks sir , it helps me a lot

[iHacker-n00b]

well, in pgsql we have xml function named xmlparse().
when we use it, our code goes thru xml parse, and we get the output.
in pgsql injection, the payload would look like that-

Code

select xmlparse(document '<!DOCTYPE a [ <!ENTITY xxe SYSTEM "/etc/passwd">]><content>&xxe;</content>');

and we get pg error-
parser error : StartTag: invalid element name exec 9<&0 <root:x:0:0:root
we can also use it for ssrf btw.
another function is xslt_process(), and the good thing about that function, its not limited by the output.
the problem is its not working on every version.
in pg 9.1 its turned off by default.

Cool :O Thanks For This Info , Very Nice One Bro! 👍

[benzi]

Am I fully r3t4rd3d or......, are you in jail?? o.O
hahahah

i belive he mean he is busy.
thanks all.

[⭐WhatTheJoint⭐]

תודה רבה בנצי

Great xss injection tut.

[iHacker-n00b]

Why Can't we use php://input or data:// wrapper?

[Hooded Robin]

Why Can't we use php://input or data:// wrapper?

if the application is running PHP, you can use stream wrappers to manipulate your xxe data within your XML/XXE injection. There was a really good explanation released today relating to the latest vulnerability found in Drupal framework which can show you how and why some filters work and how to go about using them within your XXE injection to avoid XML issues with input and output data (also a few tricks on bypassing some default restrictions in XXE data smugling): http://www.synacktiv.fr/ressources/synac...rvices.pdf

[iHacker-n00b]

if the application is running PHP, you can use stream wrappers to manipulate your xxe data within your XML/XXE injection. There was a really good explanation released today relating to the latest vulnerability found in Drupal framework which can show you how and why some filters work and how to go about using them within your XXE injection to avoid XML issues with input and output data (also a few tricks on bypassing some default restrictions in XXE data smugling): http://www.synacktiv.fr/ressources/synac...rvices.pdf

Thanks For The reply Sir, 🤝!

[knightserv]

Awesome tutorial! Learned something new! i put this in a book to know what to do next time thank...

[tty666]

Really nice tut :)
let's automatize this with Python ^^
I will code a short scrapper :p

thx !

[Geneon]

What software are you using to post data?

[Broomop]

good method but i tried about 40 sites and now im bored lol nothing.