◦
How we got read access on Google’s production servers
blog
The team at Detectify found a way to access files on one of google’s production server. Thanks to an old google product (google toolbar) that was using a poorly secured XML parser.
They just used a simple XXE attack where they uploaded a poisoned xml files and saw what the application printed back
a xxe looks like this:
<!DOCTYPE foo [
<!ELEMENT foo ANY >
<!ENTITY xxe SYSTEM “file:///etc/passwd” >]>
suggested reads: