Merge pull request #902 from nowak0x01/patch-2

Added a technique that allows obtaining RCE through XSS in Drupal CMS.

network-services-pentesting/pentesting-web/drupal/README.md

@@ -112,6 +112,11 @@ If you have access to the Drupal web console check these options to get RCE:
 [drupal-rce.md](drupal-rce.md)
 {% endcontent-ref %}
 
+## Drupal From XSS to RCE
+Through this technique, it is possible to achieve **Remote Code Execution (RCE)** in Drupal via **Cross-Site Scripting (XSS)**. https://github.com/nowak0x01/Drupalwned
+<br><br>
+**For more detailed steps check:** https://nowak0x01.github.io/papers/76bc0832a8f682a7e0ed921627f85d1d.html
+
 ## Post Exploitation
 
 ### Read settings.php