ch0ic3/PayloadsAllTheThings
1
0
Fork 0
mirror of https://github.com/swisskyrepo/PayloadsAllTheThings.git synced 2025-02-21 14:16:07 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Merge pull request #768 from sehraramiz/sehraramiz-patch-xxe-1
Some checks are pending
mkdocs-build / deploy (push) Waiting to run
Details

Browse Source 
Add missing -r flag for xxe excel file rebuilding with zip command
This commit is contained in:
Swissky 2025-02-18 21:49:42 +01:00 committed by GitHub
commit dd946bedc0
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
XXE Injection/README.md
View File

@ -596,7 +596,7 @@ Rebuild Excel file:
```
$ cd XXE
$ zip -u ../xxe.xlsx *
$ zip -r -u ../xxe.xlsx *
```
Warning: Use `zip -u` (https://infozip.sourceforge.net/Zip.html) and not `7z u` / `7za u` (https://p7zip.sourceforge.net/) or `7zz` (https://www.7-zip.org/) because they won't recompress it the same way and many Excel parsing libraries will fail to recognize it as a valid Excel file. A valid magic byte signature with (`file XXE.xlsx`) will be shown as `Microsoft Excel 2007+` (with `zip -u`) and an invalid one will be shown as `Microsoft OOXML`.