DataViewManagerXxe

gadget

Sets DataViewSettingCollectionString so the target's legacy XmlTextReader fetches an external DTD. Fires when the target app uses pre-4.5.2 XML resolver defaults, when the machine turned the EnableLegacyXmlSettings switch back on, or when the app declares NO target framework moniker at all - an ASP.NET app with no <httpRuntime targetFramework> is legacy even on a fully patched 4.8.1 machine.

Declared metadata, not a runtime result. How to read evidence.

.\ysonet.exe -g DataViewManagerXxe -h

Target declarations

Variant	Formatters	Inputs	Requirements	Runtime tokens
Default	Xaml, JavaScriptSerializer, FastJson, SharpSerializerXml, SharpSerializerBinary	remote-url	built-in, net-framework	net-fx-4.0, net-fx-4.5, net-fx-4.5.1

Options (1)

Option	Help	Default	Required
rawinput	Skip the URL validation and put -c into the DTD external identifier exactly as typed, with no trimming. Normal mode accepts an absolute http or https URL and refuses whitespace, control characters and the characters " < > \, because the value goes inside a QUOTED DTD external identifier and those would corrupt or escape it. Use this only for research on a resolver that accepts something else; the network effect this gadget declares was proven with http(s). It does NOT turn off the outer formatter's escaping, so the payload is still a valid document - but nothing checks that the identifier inside it still is, and a broken one simply fetches nothing. Default value: "false".	false	false

Credit: [Finders: Oleksandr Mirosh, Alvaro Munoz] [Contributors: Soroush Dalili]

All modules · Full catalog JSON