An Out-of-Band XXE server for retrieving file contents over FTP.

README
Issues 5

Out-of-Band XXE tool
A python script to achieve file read via FTP!

230OOB is a tool that emulates an FTP server, assisting you in achieving file read via Out-of-Band XXE.

Installation

git clone https://github.com/lc/230-OOB

Usage:

Generate an XXE payload & DTD at http://xxe.sh

Start the server:

python3 230.py 2121

everything will be logged to -> extracted.log

1 Open More issues

Closed

Fixed the Clone Instruction

opened May 27, 2020 by TiranaCorp 1

Closed

Fixes #1. This PR implements a slightly different response for the USER and PASS command, which makes sure FTP clients don't fail when they receive an unexpected response when they authenticate. Every username/password combination is accepted by default.

This PR also includes two boy scouts: cleaned up some whitespace and I added the extracted.log file to the gitignore list to avoid having an unstaged file when you run the script from the repository.

opened Dec 26, 2017 by jobertabma 1

Closed

Inventory notification

Your tool/software has been inventoried on Rawsec's CyberSecurity Inventory:

https://inventory.rawsec.ml/tools.html#230-OOB

What is Rawsec's CyberSecurity Inventory?

An inventory of tools and resources about CyberSecurity. This inventory aims to help people to find everything related to CyberSecurity.

More details about features here.

Note: the inventory is a FLOSS (Free, Libre and Open-Source Software) project.

Why should you care about being inventoried?

Mainly because this is giving visibility to your tool and improve its referencing.

Badges

The badge shows to your community that your are inventoried. It looks good but also shows you care about your project, that your tool is referenced.

Feel free to claim your badge here: http://inventory.rawsec.ml/features.html#badges, it looks like that , but there are several styles available.

Want to thank us?

If you want to thank us, you can help make our open project better known by tweeting about it! For example:

So what?

That's all, this message is just to notify you if you care. Else you can close this issue.

opened Dec 12, 2019 by noraj 0

Closed

Implement dummy authentication for better spec implementation

opened Dec 26, 2017 by jobertabma 0

Open

230-OOB always crash after the 1st received message

$ python3 230.py 2121

=--------------------------------------=
|  230 OOB || an Out-Of-Band XXE tool  |
|    ____  _____  ___   ___  ____      |
|   (___ \(__  / / _ \ / _ \|  _ \     |
|     __) ) / / | | | | | | | |_) )    |
|    / __/ (__ \| | | | | | |  _ (     |
|   | |___ ___) ) |_| | |_| | |_) )    |
|   |_____|____/ \___/ \___/|____/     |
|              by Corben Leo           |
|                                      |
|      - https://www.corben.io         |
|      - https://hackerone.com/cdl     |
|      - https://twitter.com/hacker_   |
=--------------------------------------=

[+] 230OOB started on port: 2121
[*] Connection from: 172.20.0.2!
USER anonymous
 /NDc0ZmU3ZDNiZjMyCg==
TYPE I
SIZE /NDc0ZmU3ZDNiZjMyCg==
MDTM /NDc0ZmU3ZDNiZjMyCg==

Traceback (most recent call last):
  File "230.py", line 75, in <module>
    main()
  File "230.py", line 62, in main
    conn.sendall(response)
BrokenPipeError: [Errno 32] Broken pipe

opened Nov 3, 2019 by noraj 0