Top 10 winner

can I speak to your manager? hacking root EPP servers to take control of zones

Sam Curry, Brett Buerhaus, Rhys Elsmore and Shubham Shah · hackcompute · 12 June 2023

EPP servers used by domain registries, most of them running CoCCA registry software, parsed XML with external entities enabled, giving unauthenticated file read on port 700. Chained with a path traversal in an unauthenticated cities servlet it yielded SSH keys, database backups and a shared cloud backup credential, giving control of the DNS zones of 19 ccTLDs.

Record

Researcher

Sam Curry, Brett Buerhaus, Rhys Elsmore and Shubham Shah

Published by

hackcompute

Date

12 June 2023

Topic

Server

In the archive

• Ranked #10 in the 2023 Top 10 Web Hacking Techniques

Tags

• xxe
• path-traversal
• dns
• lfi
• java
• info-leak
• attack-chain
• owasp-a01-2021
• owasp-a03-2021

This page is the archive's own catalogue record. The research is the work of Sam Curry, Brett Buerhaus, Rhys Elsmore and Shubham Shah, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 9 August 2026.