diff --git a/XXE Injection/README.md b/XXE Injection/README.md index cb7d559f..4598997d 100644 --- a/XXE Injection/README.md +++ b/XXE Injection/README.md @@ -591,7 +591,7 @@ cd XXE zip -r -u ../xxe.xlsx * ``` -Warning: Use `zip -u` () and not `7z u` / `7za u` () or `7zz` () because they won't recompress it the same way and many Excel parsing libraries will fail to recognize it as a valid Excel file. A valid magic byte signature with (`file XXE.xlsx`) will be shown as `Microsoft Excel 2007+` (with `zip -u`) and an invalid one will be shown as `Microsoft OOXML`. +Warning: Use `zip -u` () and not `7z u` / `7za u` () or `7zz` () because they won't recompress it the same way and many Excel parsing libraries will fail to recognize it as a valid Excel file. A valid magic byte signature with (`file XXE.xlsx`) will be shown as `Microsoft Excel 2007+` (with `zip -u`) and an invalid one will be shown as `Microsoft OOXML`. Alternatively, with 7z you can specify the correct compression algorithm with: `7z a -tzip` to get the correct signature. Add your blind XXE payload inside `xl/workbook.xml`.