Web Application Security on soffensive blog

XXE with .NET in 2019

Sat, 18 May 2019 05:35:00 -0700

After the seminal blog post by James Jardine in 2016 on XXE exploitation in .NET applications back in 2016, Microsoft seems to have implemented some additional changes regarding the default behavior of XML parsers.

We work through the different XML methods provided and their corresponding vulnerable configurations. For all experiments, .NET framework 4.6 was chosen.

TL;DR

In order to create an XXE vulnerability for applications using .NET framework 4.6+, you have to instantiate a vulnerable XmlResolver beforehand.

Exploiting Blind File Reads / Path Traversal Vulnerabilities on Microsoft Windows Operating Systems

Tue, 19 Jun 2018 01:31:00 -0700

In a recent engagement I was confronted with a blind path traversal vulnerability on a server running with the Microsoft Windows operating system. That is, it was not possible to display folder contents but the complete file name and path had to be guessed. Due to the lack of a comprehensive website I was forced to gather information from various different sources.

In this blog post, I want to summarize my findings and focus on the exploitation of this kind of vulnerability.

Exploiting misconfigured CORS Null Origin

Mon, 23 Apr 2018 08:04:00 -0700

Almost two years ago, in October 2016, James Kettle published an excellent blog post about the various types of Cross-Origin Resource Sharing (CORS) misconfigurations and how they can be exploited.

Recently, I encountered a web application that allowed for two-way interaction with the so-called null origin. More precisely, when sending an HTTP request specifying the header:

1

Origin: null

the server would respond with the following two HTTP headers:

Cross-Site Scripting Attacks with adverse Conditions: Upper-Case XSS

Wed, 05 Apr 2017 04:03:00 -0700

Several times I have encountered web applications that convert user-provided input to capital letters. For example, the application may behave as follows:

The injected JavaScript code (after escaping from the quotes, of course) will not be executed in the browser. Why is this the case? Remember that the HTML tag names themselves, including <SCRIPT> are not case-sensitive, whereas the contents inside them are in fact case-sensitive.