Data Exfiltration via Formula Injection #Part1
In Summary : Due to a recent intriguing client pentest we became increasingly interested in finding and documenting ways to extract data ...
https://updatesinfosec.blogspot.com/2018/05/data-exfiltration-via-formula-injection.html
In Summary :
Due to a recent intriguing client pentest we became increasingly interested in finding and documenting ways to extract data from spreadsheets using out of band (OOB) methods. The methods we describe in this article assume that we have some control over the content of the spreadsheet (albeit limited), but we may have little to no access to the full document or client (target) system.We have had a cursory look at LibreOffice as well as Google Sheets and have provided a few PoCs for each. We specifically paid attention to non-Windows based applications as a lot of work has already been done in this area, and we didn’t want to regurgitate information that is already widely accessible. [...]
kindly refer the following link as follow up :
https://ift.tt/2LExbGt
Due to a recent intriguing client pentest we became increasingly interested in finding and documenting ways to extract data from spreadsheets using out of band (OOB) methods. The methods we describe in this article assume that we have some control over the content of the spreadsheet (albeit limited), but we may have little to no access to the full document or client (target) system.We have had a cursory look at LibreOffice as well as Google Sheets and have provided a few PoCs for each. We specifically paid attention to non-Windows based applications as a lot of work has already been done in this area, and we didn’t want to regurgitate information that is already widely accessible. [...]
kindly refer the following link as follow up :
https://ift.tt/2LExbGt
