How to run dtd-finder without Docker on a local system?

Build it using Maven with 'mvn install', then execute the JAR file with 'java -jar dtd-finder-1.0-SNAPSHOT-all.jar' against tar files or directories, as detailed in the README. Ensure you have Java installed and the target filesystem snapshot available.

What's the difference between dtd-finder and other XXE tools like XXEInjector?

DTD Finder specializes in automating local DTD discovery from filesystem snapshots to generate XXE payloads, whereas tools like XXEInjector often focus on live web application testing. DTD Finder is more suited for container analysis, while others might offer broader exploitation features.

Can dtd-finder be used to test Windows applications or servers?

Yes, it can analyze any filesystem snapshot, including those from Windows, as long as it's in a supported format like tar or a directory. However, setup requires Java, which might need additional configuration on Windows systems.

How do I interpret the markdown reports generated by dtd-finder?

The reports list found DTDs and their injectable entities, with details on exploitable XXE payloads. Use this to prioritize vulnerabilities in applications, referencing the entity names and locations for targeted exploitation during security assessments.

Is dtd-finder suitable for beginners in penetration testing?

Not ideally, as it assumes familiarity with XXE concepts, Java environments, and command-line tools. Beginners might struggle with setup and interpreting results without prior security testing experience.

Does dtd-finder require internet access to function?

No, it operates offline on local filesystem snapshots, making it useful for isolated environments. Internet is only needed for initial Docker image pulls or updates, if using the Docker method.

Open-Awesome

dtd-finder

Kotlin1.1

A security tool that identifies DTDs in filesystem snapshots and generates XXE payloads using those local DTDs.

Visit Website GitHub

663 stars115 forks0 contributors

What is dtd-finder?

DTD Finder is a security tool that scans filesystem snapshots—such as those from Docker containers or server directories—to locate Document Type Definition (DTD) files. It then tests these DTDs to generate XML External Entity (XXE) attack payloads, helping identify exploitable XXE vulnerabilities in applications.

Target Audience

Security researchers, penetration testers, and application security professionals who need to automate the discovery of local DTDs for XXE exploitation during security assessments.

Value Proposition

It automates the manual and time-consuming process of finding and testing local DTDs for XXE, providing ready-to-use payloads and detailed reports, which streamlines vulnerability discovery in complex environments like containerized applications.

Overview

List DTDs and generate XXE payloads using those local DTDs.

Use Cases

Best For

Identifying XXE vulnerabilities in Java-based web applications
Analyzing Docker container filesystems for local DTDs
Penetration testing of enterprise applications like Oracle WebLogic
Automating security assessments of archived filesystem snapshots
Generating exploit payloads for known XXE attack vectors
Security research on local DTD inclusion in XML parsers

Not Ideal For

Developers needing general XML validation or processing tools
Teams without Java or Maven expertise for setup and execution
Projects requiring real-time, live system scanning for vulnerabilities
Environments where automated exploitation testing is restricted by policy

Pros & Cons

Pros

Automated DTD Discovery

Scans filesystem snapshots like tar files or directories to locate all DTD files, as shown in the CLI examples targeting Docker exports.

XXE Payload Generation

Tests discovered DTDs to identify injectable entities and creates ready-to-use XXE payloads, outputting detailed markdown reports for exploit documentation.

Docker Integration

Can be run via Docker for easy analysis of containerized filesystems, demonstrated in the usage section with docker export commands.

Comprehensive Reporting

Outputs a detailed markdown report listing found DTDs and their exploitable entities, streamlining vulnerability assessment workflows.

Cons

Java Dependency

Requires a Java runtime and Maven for building, adding setup complexity for users unfamiliar with Java ecosystems, as noted in the installation steps.

Niche Focus

Solely targets XXE exploitation via local DTDs, lacking features for broader XML security testing or other vulnerability types mentioned in the description.

Limited Real-Time Use

Primarily designed for static filesystem snapshots, not for scanning live applications or dynamic environments, which restricts its applicability in ongoing assessments.

Frequently Asked Questions

Related Projects

XML Out-Of-Band Data Retrieval

Written by @a66at and Alexey Osipov

Stars0

Forks0

Last commit

Forcing XXE Reflection through Server Error Messages

Written by Antti Rantasaari

Stars0

Forks0

Last commit

XXE in WeChat Pay Sdk ( WeChat leave a backdoor on merchant websites)

Written by Rose Jackcode

Stars0

Forks0

Last commit

What You Didn't Know About XML External Entities Attacks

Written by Timothy D. Morgan

Stars0

Forks0

Last commit

Community-curated · Updated weekly · 100% open source

Found a gem we're missing?

Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.

Submit a project Star on GitHub

dtd-finder

Kotlin1.1

A security tool that identifies DTDs in filesystem snapshots and generates XXE payloads using those local DTDs.

Visit Website GitHub

663 stars115 forks0 contributors

What is dtd-finder?

Target Audience

Security researchers, penetration testers, and application security professionals who need to automate the discovery of local DTDs for XXE exploitation during security assessments.

Value Proposition

Overview

List DTDs and generate XXE payloads using those local DTDs.

Use Cases

Best For

Identifying XXE vulnerabilities in Java-based web applications
Analyzing Docker container filesystems for local DTDs
Penetration testing of enterprise applications like Oracle WebLogic
Automating security assessments of archived filesystem snapshots
Generating exploit payloads for known XXE attack vectors
Security research on local DTD inclusion in XML parsers

Not Ideal For

Developers needing general XML validation or processing tools
Teams without Java or Maven expertise for setup and execution
Projects requiring real-time, live system scanning for vulnerabilities
Environments where automated exploitation testing is restricted by policy

Pros & Cons

Pros

Automated DTD Discovery

Scans filesystem snapshots like tar files or directories to locate all DTD files, as shown in the CLI examples targeting Docker exports.

XXE Payload Generation

Tests discovered DTDs to identify injectable entities and creates ready-to-use XXE payloads, outputting detailed markdown reports for exploit documentation.

Docker Integration

Can be run via Docker for easy analysis of containerized filesystems, demonstrated in the usage section with docker export commands.

Comprehensive Reporting

Outputs a detailed markdown report listing found DTDs and their exploitable entities, streamlining vulnerability assessment workflows.

Cons

Java Dependency

Requires a Java runtime and Maven for building, adding setup complexity for users unfamiliar with Java ecosystems, as noted in the installation steps.

Niche Focus

Solely targets XXE exploitation via local DTDs, lacking features for broader XML security testing or other vulnerability types mentioned in the description.

Limited Real-Time Use

Primarily designed for static filesystem snapshots, not for scanning live applications or dynamic environments, which restricts its applicability in ongoing assessments.