Comments (6)
Hey offsecguy, is the dvws setup on Linux or Windows?
It should work on Linux. All the payloads you used are technically correct but it needs to be slightly modified to be interpreted by the simplexml_load_string parser. The entire XXE payload needs to be in the name parameter for the XXE to be processed. I admit that this is because the simplexml_load_string's function is to take all XML value given within a parameter and convert it to string. I will defo do a rewrite with more realistic parser in the coming month.
---------------------------Example payloads (works on linux)--------------------------------------------
EDIT: Github not showing html tag here are some examples on pastebin
http://pastebin.com/zqpVZ3mA
references: http://php.net/manual/en/function.simplexml-load-string.php
from dvws.
Hey thanks for responding.
Yes I had tried on Kali Linux rolling version, and to make sure latest
debain is not blocking or preventing attack I tried on beebox old
vulnerable Ubuntu box too.
I will try entire XML inside name parameter as you suggested and let you
know.
Any particular reason to send parameter value as text and forward it to XML
parser? Can't we send data as XML ?
On 15-Feb-2016 23:13, "snoopythesecuritydog" [email protected]
wrote:
Hey offsecguy, is the dvws setup on Linux or Windows?
It should work on Linux. All the payloads you used are technically correct
but it needs to be slightly modified to be interpreted by the
simplexml_load_string parser. The entire XXE payload needs to be in the
name parameter for the XXE to be processed. I admit that this is because
the simplexml_load_string's function is to take all XML value given within
a parameter and convert it to string. I will defo do a rewrite with more
realistic parser in the coming month.---------------------------Example payloads (works on
linux)--------------------------------------------name=
]>&xxe;
name=]>&xxe;
references: http://php.net/manual/en/function.simplexml-load-string.php
—
Reply to this email directly or view it on GitHub
#1 (comment)
.
from dvws.
It was a mistake on my part e.g. the way I implemented it. Most real scenarios I've seen takes the entire request to be processed. Cheers for pointing this out. Will do an update soon. :)
from dvws.
added xxe2. This one is a bit better and works as intended.
from dvws.
Perfect, works great :)
Hope in future you will add other vulnerabilities as you have listed in your to-do list. Please let me know if i could contribute in any way, i am not very good in development, however i can take some task which may be time consuming and repetitive for you.
from dvws.
Ok will do, thanks
from dvws.
Related Issues (7)
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from dvws.