Get the latest tech news
Hacking TLD EPP registry servers (2023)
Finding vulnerabilities in global domain infrastructure to take control of ccTLD zones. Vulnerabilities in EPP
While the protocol is quite simple, many registries make an effort to secure access to their EPP servers through the enforcement of mutual TLS or requiring certain certificates in your CA chain to be able to communicate with them. Coming from the web application security angle, our immediate thoughts for targeting this protocol was testing for the presence of XML external entity injection. Given that the files obtained via this vulnerability gave us his SSH private key, we validated that we could login to his server, which contained several GPG encrypted backups of the entire .AI registry.
Or read this on Hacker News