Security research, field notes, and practical experiments
Independent technical notes by Willis Vandevanter.
In this two part series we are going to take Burp Suite Project files as input from the command line, parse them, and then feed them into a testing pipeline.
The series is broken down into two parts:
SSRF protocol smuggling involves an attacker injecting one TCP protocol into a dissimilar TCP protocol. A classic example is using gopher (i.e. the first protocol) to smuggle SMTP (i.e. the second protocol):
|
I recently (May 2018) published odle which is a Ruby gem and binary that takes XML data from various security tools and outputs their JSON equivalent. The goal is …
Recently ColdFusion was shown vulnerable to XXE based attacks in OXML documents;
Finding hosts or domain names associated with a company where the domain name does not include the name of the company can sometimes be difficult. There are common ways to do it such as ASN or scope information (e.g. bug bounty ToE or IP block).
One technique …
Just wanted to post some details from my BH USA 2015 briefing “Exploiting XXE In File Upload Functionality”.
https://www.youtube.com/watch?v=LZUlw8hHp44
I …
I landed the SSRF Cloud Metadata technique in a few different scenarios recently. If you haven’t seen the talk BHUSA 2014 - Bringing a Machete to the Amazon I …
An XML Entity testing cheatsheet. This is an updated version with nokogiri tests removed, just (X)XE notes.
XML Declaration(s):
| |
Last month at Blackhat Arsenal 2015, Pete and I presented on Serpico. This was our second time at Arsenal. Yet again, awesome people, great venue, and overall a …
I was researching something else and thought this was a cool way to execute a command through the open method in ruby:
| |
The key is starting the open with pipe. For example,
| |
Or to exec and print the …