0

In my current assessment, I came across an XXE. Unfortunately, I cannot retrieve a bunch of files that would let me progress further (such as .bash_history and any other .xml/config files) because the xml parser just hangs if it encounters any special chars in the file (such as <, ", etc...)

Is there a way to force the xml parser to encode the file's content (in b64 for example) first and only then return it?

1 Answer 1

0

You should wrap your data in CDATA. It's a bit tricky but the technique is well explained here.

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .