Hands-on Penetration Testing for Web Applications by Richa Gupta

Author:Richa Gupta [Gupta, Richa]
Language: eng
Format: epub
ISBN: 9789389328547
Publisher: BPB Publications
Published: 2021-07-15T00:00:00+00:00

<?xml version="1.0" encoding="ISO-8859-1"?>

<!DOCTYPE foo [

<!ELEMENT foo ANY >

<!ENTITY xxe SYSTEM "file:///etc/shadow" >]>

<foo>&xxe;</foo>

XXE attacks can be used to perform various tasks as follows.

Exploiting XXE to retrieve files

An XXE attack can be exploited to retrieve arbitrary files from the server file system. For this exploitation, we need to modify the submitted XML in the following ways:

Add or edit a DOCTYPE element that defines an external entity containing the path to the file from the server file system.

Edit a data value in the XML which will be returned in the application's response to make use of the defined external entity.

Download

Copyright Disclaimer:
This site does not store any files on its server. We only index and link to content provided by other sites. Please contact the content providers to delete copyright contents if any and email us, we'll remove relevant links or contents immediately.