PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Impossible XXE in PHP

swarm.ptsecurity.com | research | #php | #web-security | #xxe | #libxml2 | #parameter-entities
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

PT SWARM shows an 'almost impossible' XXE in PHP is exploitable by defeating four defenses — disabled entity loading, LIBXML_NONET, missing NOENT, a DOM nodeType check — using parameter entities.
Published
Collected

Related coverage

research · swarm.ptsecurity.com
Getting XXE in Web Browsers using ChatGPT
Can a JavaScript-less page read local files? ChatGPT-generated samples expose browser XSL/XML vectors — XSLT, XInclude and document() — that reach file:// content despite the SOP.
research · portswigger.net
Top 10 web hacking techniques of 2018
James Kettle announces the Top 10 web hacking techniques of 2018 chosen from 59 nominations, including XS-Search on Google's bug tracker and XXE via local DTD files.
research · bugcrowd.com
Supporting Researcher Success through Education & Collaboration
Bugcrowd added five Bugcrowd University modules on Burp Suite, SSRF, XXE, and recon, verified skills matching, and researcher collaboration with joint submissions and reward splitting.
research · bugcrowd.com
Researcher Spotlight: Mongo
Bugcrowd spotlights Mongo, a former developer who reached 8th on its leaderboard within six months of his first submission, explaining his CTF roots and preference for hunting XXE and RCE bugs.
research · github.com
Steal My Bitcoin Challenge Writeup: PHP 8.4.26 Session Upload Progress Memory Exhaustion Analysis
Provides a detailed binary-level case study on PHP Zend memory manager behavior and worker state persistence after fatal out-of-memory errors.
research · projectdiscovery.io
PHP2Shell: finding and patching affected PHP
Two CVSS 9.2 bugs in the PHP runtime allow unauthenticated code execution; the patch is a package upgrade and a restart, and this guide shows how to find every PHP runtime you need to patch.
Back