in the last weeks, I demonstrated at HackInTheBox Amsterdam and
HackInParis a Metasploit module used to gain Meterpreter shells from
XSLT vulnerabilities.
Given the questions I received, I chose to publish a blog-post
explaining the overall concept and some implementation details. The
article is available here: http://www.agarri.fr/blog/
The vulnerable PHP and JSP applications used during the talk are
included. Furthermore, the video of the HackInTheBox talk is online:
http://www.youtube.com/watch?v=_0mNSAbsRaU
in the last weeks, I demonstrated at HackInTheBox Amsterdam and
HackInParis a Metasploit module used to gain Meterpreter shells from
XSLT vulnerabilities.
Given the questions I received, I chose to publish a blog-post
explaining the overall concept and some implementation details. The
article is available here: http://www.agarri.fr/blog/
The vulnerable PHP and JSP applications used during the talk are
included. Furthermore, the video of the HackInTheBox talk is online:
http://www.youtube.com/watch?v=_0mNSAbsRaU
Regards,
Nicolas Grégoire
[ reply ]