// HackTricks · Web Pentesting

PDF Upload: XXE and Same-Origin Policy Bypass

PDF files can contain actions, forms, and references to external resources, so an upload feature may expose more than document-rendering risk. The linked research documents historical Adobe Reader issues involving external entities and a same-origin-policy bypass, often described as a CORS bypass. Treat its proof of concept as version-specific: reproduce it only with the affected reader and browser integration, and verify current behavior independently.^[1]

References

[1] InsertScript - Multiple PDF Vulnerabilities: Text and Pictures on Steroids

☧ CPTS · ordered posts

Locked

Unlock with your Main_Key through local GPG.

Start the local GPG helper

In your cheatsheet checkout, run:

npm run unlock:helper

Open the link it prints, or paste its pairing code below. Keep the terminal open until GPG finishes.

Import an index you already decrypted

Download the encrypted index, then decrypt with GPG:

gpg --output report-index.json --decrypt report-index.gpg

Choose your decrypted JSON once to save access:

Your private key stays in GPG. The decrypted index is saved in this browser so you can reopen it after navigation, refreshes and restarts. Lock this browser or clear this site's browser data to remove the saved index. Nothing is uploaded.