Top 10 winner

Timur Yunusov and Alexey Osipov -- XML Out of Band Data Retrieval

Timur Yunusov and Alexey Osipov · media.blackhat.com

A Black Hat EU talk on pulling data out of XML parsers that return neither errors nor document output. Nested parameter entities loaded from an attacker-controlled external DTD smuggle file contents into a URL, and XSLT's document() and unparsed-text() do the same, exfiltrating over DNS or HTTP. Compares MS System.XML, Java Xerces and libxml, and ships a Metasploit module.

Record

Researcher

Timur Yunusov and Alexey Osipov

Published by

media.blackhat.com

Format

Slides

In the archive

• Ranked #6 in the 2013 Top 10 Web Hacking Techniques

Tags

• injection
• xxe
• dns
• owasp-a03-2021

This page is the archive's own catalogue record. The research is the work of Timur Yunusov and Alexey Osipov, first published at the original source. Preserved copies are kept so the citation survives its host.