Top 10 winner
Timur Yunusov and Alexey Osipov -- XML Out of Band Data Retrieval
XML Out-Of-Band Data Retrieval
A Black Hat EU talk on pulling data out of XML parsers that return neither errors nor document output. Nested parameter entities loaded from an attacker-controlled external DTD smuggle file contents into a URL, and XSLT's document() and unparsed-text() do the same, exfiltrating over DNS or HTTP. Compares MS System.XML, Java Xerces and libxml, and ships a Metasploit module.
Record
- Document
- XML Out-Of-Band Data Retrieval
- Researcher
- Timur Yunusov and Alexey Osipov
- Published by
- media.blackhat.com
- Format
- Slides
- Topic
- Other
In the archive
Tags
This page is the archive's own catalogue record. The research is the work of Timur Yunusov and Alexey Osipov, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .