Resources

People often ask me "How did you learn how to hack?" The answer: by reading. This page is a collection of the blog posts and other articles that I have accumulated over the years of my journey. Enjoy!

Oracle Peoplesoft: XXE to RCE- 32

AmbionicsPosted 6 Years Ago
  • The GET/POST parameters were being translated into SOAP request (sort of like REST but with XML).
  • By exploiting this feature, it was possible to write your own XML to alter the request.
  • By using AXIS (WTF this is) it was possible to get an RCE, just from writing the XML!