snoopysecurity

libxml2 XXE demo code

dpkg -s libxml2-dev
#output
Package: libxml2-dev
Status: install ok installed
Multi-Arch: same
Priority: optional

snoopysecurity

OTF+SVG allows to read info character by character with only a STYLE injection through XEE & timing

Intro

Mozilla Firefox supports a feature that allows to define SVG images inside an OTF font to represent characters. This is useful if we for example want to work with colorful characters, Emoji, animated characters and so on. Firefox is currently the only relevant browser supporting this technology.

The general technology and its advantages are described here:

• https://hacks.mozilla.org/2014/10/svg-colors-in-opentype-fonts/

snoopysecurity

<img alt="<x" title="/><img src=url404 onerror=xss(0)>">

<img alt="
<x" title="/>
<img src=url404 onerror=xss(1)>">

<style><style/><img src=url404 onerror=xss(2)>

<xmp><xmp/><img src=url404 onerror=xss(3)>

snoopysecurity

<?php
/**
 * @link http://stackoverflow.com/q/10212752/367456
 * @link http://msdn.microsoft.com/en-us/magazine/ee335713.aspx
 */

$file = 'billion-laughs-2.xml';
$file = 'quadratic-blowup-2.xml';

printf("Mem: %s (Peak: %s)\n", number_format(memory_get_usage(), 0, '', ' '), number_format(memory_get_peak_usage(), 0, '', ' '));

snoopysecurity

<?php
// Extended tester from ezimuel (https://gist.github.com/ezimuel/9135151)
// The libxml entity loader is disabled by default
// even setting the libxml_disable_entity_loader to false doesn't works!
//
// @see http://uk3.php.net/manual/en/function.libxml-disable-entity-loader.php
// @see http://stackoverflow.com/a/10213239
// @see https://stackoverflow.com/questions/24117700

$dir = __DIR__;

snoopysecurity

{
    "proxy":{
        "ssl_pass_through":{
            "automatically_add_entries_on_client_ssl_negotiation_failure":false,
            "rules":[
                {
                    "enabled":true,
                    "host":".*\\.google\\.com",
                    "protocol":"any"
                },

snoopysecurity

Gettings started writing a ESLint rule

First, take a look at the ESLint rule documentation. Just skim it for now. It's very long and boring. You can come back to it later.

ESLint rules works on the AST (Abstract Syntax Tree) representation of the code. In short, this is a tree structure that describes the code in a very verbose form. ESLint walks this tree and rules can subscribe to be notified when it hits a specific node type, like a Literal type, which could be the "hello" part of const welcome = "hello";.

Go ahead and play around with some code in AST Explorer (Make sure the parser is espree). It's a great tool!

Here are some good articles on the subject (ignore the scaffolding parts):

• https://insideops.wordpress.com/2015/12/08/creating-custom-rules-for-eslint/

snoopysecurity

$$
$Any$
$shop$
$your-shop$
%20%44omain%20%3d
%2f%2f%2fbing
%60x
%domain%
%user%
%your_domain%

snoopysecurity

-
.
..
...
....
.AMRU
.json
.onion
.txt
0

snoopysecurity

Set-Cookie=test=test

"--><svg
"><script>prompt("exr")<
$
$1
$a
$account_id
$code