Security research, field notes, and practical experiments
Writing
Independent technical notes by Willis Vandevanter.
Recent writing
Building on an AppSec Pipeline with Burp Suite data - Part 2
In this two part series we are going to take Burp Suite Project files as input from the command line, parse them, and then feed them into a testing pipeline.
The series is broken down into two parts:
- Getting at the Data (i.e. from the CLI to feeding the …
Building on an AppSec Pipeline with Burp Suite data - Part 1
In this two part series we are going to take Burp Suite Project files as input from the command line, parse them, and then feed them into a testing pipeline. Â
The series is broken down into two parts:
- Getting at the Data (i.e. from the CLI to feeding the …
SSRF Protocol Smuggling in Plaintext Credential Handlers : LDAP
SSRF protocol smuggling involves an attacker injecting one TCP protocol into a dissimilar TCP protocol. A classic example is using gopher (i.e. the first protocol) to smuggle SMTP (i.e. the second protocol):
1 …odle ruby gem: piping security data
I recently (May 2018) published odle which is a Ruby gem and binary that takes XML data from various security tools and outputs their JSON equivalent. The goal is …
Exploiting CVE-2016-4264 With OXML_XXE
Recently ColdFusion was shown vulnerable to XXE based attacks in OXML documents;
Finding Hosts Using SSL Certificate Organization And Censys
Finding hosts or domain names associated with a company where the domain name does not include the name of the company can sometimes be difficult. There are common ways to do it such as ASN or scope information (e.g. bug bounty ToE or IP block).
One technique …
Exploiting XXE In File Upload Functionality
Just wanted to post some details from my BH USA 2015 briefing “Exploiting XXE In File Upload Functionality”.
https://www.youtube.com/watch?v=LZUlw8hHp44
I …
Cloud Metadata URL List
I landed the SSRF Cloud Metadata technique in a few different scenarios recently. If you haven’t seen the talk BHUSA 2014 - Bringing a Machete to the Amazon I …
XML Entity Cheatsheet - Updated
An XML Entity testing cheatsheet. This is an updated version with nokogiri tests removed, just (X)XE notes.
XML Declaration(s):
1 2<?xml version="1.0" standalone="no"?> <?xml version="1.0" standalone="yes"?> …