Etiqueta: Practitioner

Exploiting path delimiters for web cache deception

Server-side template injection with information disclosure via user-supplied objects

Server-side template injection in an unknown language with a documented exploit

Server-side template injection using documentation

Exploiting XXE via image file upload

Exploiting XInclude to retrieve files

Exploiting blind XXE to retrieve data via error messages

Exploiting blind XXE to exfiltrate data using a malicious external DTD

Blind XXE with out-of-band interaction via XML parameter entities

Blind XXE with out-of-band interaction