Comments (1)
Hello,
Request file is just valid HTTP request with XML somewhere (parameter,
whole body, etc.). If XML is already in the request file then tool
automatically detects it and injects DTD to exploit vulnerability. You can
also specify XXEINJECT mark where DTD should be injected and tool will
replace it with proper payload. If you want to manually put DTD in request
file and you do not want to automatically detect and inject payload then
you need to specify --nodtd argument. Please note that if you put DTD
manually then it needs to be specified correctly. You can run tool with
--dtd argument to see how DTD should look like.
Sample request file where tool injects payload automatically:
POST /xxe.php HTTP/1.1
Host: asd
xml=
Sample request file where tool will inject DTD in specified place:
POST /xxe.php HTTP/1.1
Host: asd
xml=XXEINJECT
Sample request file with payload manually injected according to --dtd. You
need to specify --nodtd as parameter to disable automatic payload injection:
POST /xxe.php HTTP/1.1
Host: asd
xml=%remote;%int;%trick;]>
regards
JP
2016-08-20 20:33 GMT+02:00 Rajesh Majumdar [email protected]:
Hi there!! I am mew in XXE. I just want to know what should I put in that
req.txt file Captured HTTP Requests or anything else.—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub
#1, or mute the thread
https://github.com/notifications/unsubscribe-auth/AL5OYPSfoszB0aqzF6e66RFCwGPDRT0hks5qh0higaJpZM4JpIm7
.
from xxeinjector.
Related Issues (10)
- [-] Wrong HTTP file format. HOT 1
- can't run HOT 1
- XXEinjector.rb:238:in `block in <main>': undefined method `chomp' for nil:NilClass (NoMethodError) HOT 1
- XXEinjector.rb: end of file reached (EOFError) HOT 3
- I'm getting "Specified TCP ports already in use" error
- undefined method `chomp' for nil:NilClass HOT 4
- Support images with payload HOT 1
- File without a newline at the end throws error. HOT 1
- Inventory notification
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from xxeinjector.