条件:
后端代码是否能解析xml
服务端接收JSON数据请求,将json转换为xml访问,同时修改content-type为xml。
Referer:
https://blog.netspi.com/playing-content-type-xxe-json-endpoints/
http://www.secpulse.com/archives/6256.html
http://zone.wooyun.org/content/19908
转载于:https://blog.51cto.com/0x007/1641995