The Type of Bug That We Can’t See

Continuing with our research into XXE Injections.

Vulnerabilities
are not always
straightforward to exploit,

And all the ones that are
they can be found
with Metasploit.

So some formats
won’t be readable
through basic X-X-E,

And if you think
your payload
is repeatable
Let’s see.

Since the web app
may not show us
any values through reflection,

we cannot
see the output
like we did
in other sections.

No denying…. that we must hide
our variables
with filters,

En-code our files
like Jesus did
in parables
through scriptures.