Suppose we have discovered a XXE-vulnerability and trying to do blind OOB local files content extraction. There are some different ways to do this. I recently had to use FTP-extraction (AFAIK, this was due to vulnerable service Java version – it didn’t allowed the HTTP-extraction of some files, e.g. /etc/passwd). I have used the following…
Author: skavans
How I have exploited reflected self-XSS or CORS is not the end
The other day I have stumbled upon the reflected self-XSS. It is OK, if the self-XSS is stored – in this case the injected code is stored inside some application area, which is available only for the same user, that could inject the code there, for example, inside user personal area. In my case the…