In my current assessment, I came across an XXE. Unfortunately, I cannot retrieve a bunch of files that would let me progress further (such as .bash_history and any other .xml/config files) because the xml parser just hangs if it encounters any special chars in the file (such as <, ", etc...)

Is there a way to force the xml parser to encode the file's content (in b64 for example) first and only then return it?


You should wrap your data in CDATA. It's a bit tricky but the technique is well explained here.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.