Security research, field notes, and practical experiments

Writing

Independent technical notes by Willis Vandevanter, published in reverse chronological order.

Recent writing

  5. XML Entity Cheatsheet - Updated

    An XML Entity testing cheatsheet. This is an updated version with nokogiri tests removed, just (X)XE notes.

    XML Declaration(s):

    1
2

    <?xml version="1.0" standalone="no"?>
<?xml version="1.0" standalone="yes"?> …

  6. Blackhat 2015 Arsenal

    Last month at Blackhat Arsenal 2015, Pete and I presented on Serpico. This was our second time at Arsenal. Yet again, awesome people, great venue, and overall a …

  7. Simple Ruby Exec with Open and Pipe

    I was researching something else and thought this was a cool way to execute a command through the open method in ruby:

    1

    open("|[CMD]")

    The key is starting the open with pipe. For example,

    1

    open("|ls")

    Or to exec and print the …

  • Exploiting XXE Vulnerabilities in OXML Documents - Part 1

    OXML is a common document format; think docx (Microsoft Word Document), pptx (Microsoft Powerpoint), xlsx (Excel Spreadsheet), etc.

    An OXML document is a zip file containing XML files and any media files. When the document is rendered, the rendering library …

  • ldapsearch notes

    I seem to find open LDAP servers on the Internet more often than I should. Here are some notes on using ldapsearch

    Installing ldapsearch on Ubuntu

    1

    apt-get install ldap-utils

    Root-DSE object

    nmap includes a script to gather info from a LDAP root-dse …

  • Search all Github Repositories for an Organization

    gumbler is a script I wrote to search through git commits and introduced in the blog post “Searching Through Git Commits”. Recently I wanted to run Gumbler …