Sometimes you need to proxy the http(s)-traffic of specific app when you do its debugging or pentesting. Setting the OS-wide global proxy isn’t convenient sometimes because global proxy could break some system component functionality. For instance, if you need to proxy the traffic of some iOS app, you will notice that the only option you…
Author: skavans
XXE OOB extracting via HTTP+FTP using single opened port
Suppose we have discovered a XXE-vulnerability and trying to do blind OOB local files content extraction. There are some different ways to do this. I recently had to use FTP-extraction (AFAIK, this was due to vulnerable service Java version – it didn’t allowed the HTTP-extraction of some files, e.g. /etc/passwd). I have used the following…
How I have exploited reflected self-XSS or CORS is not the end
The other day I have stumbled upon the reflected self-XSS. It is OK, if the self-XSS is stored – in this case the injected code is stored inside some application area, which is available only for the same user, that could inject the code there, for example, inside user personal area. In my case the…