Security research, field notes, and practical experiments

Writing

Independent technical notes by Willis Vandevanter, published in reverse chronological order.

Recent writing

  1. XML Entity Cheatsheet

    An XML Entity testing cheatsheet. Testing was done using an older vulnerable version of nokogiri. In IRB you can require previous versions of gems. Certain techniques (e.g. XInclude) may require additional settings in Nokogiri.

    XML Headers:

    1
    2
    
    <?xml …
  2. IPv6 DNS Guessing Notes

    A hostname with an IPv6 address is stored as a AAAA resource record in DNS (see AAAA record). There are many DNS hostname bruteforcing tools, personally I …