Shulou(Shulou.com)06/01 Report--

Reference an external DTD file to access the intranet host / port.

(see response time)

Reference external DTD files to access the wai network.

Reference an internal entity.

& xxe

External entities read local files.

& xxe

The external entity accesses the inner wang host port.

(see response time)

External entities access the wai network.

& xxe

Download the rrodrigo/xxelab image in docker

Start: docker run-d-p 8082VOL80 rrodrigo/xxelab

Grab the registration package and find that it is delivered in xml format, and the mailbox returns:

Xxe echo setting read / etc/passwd will be performed at the returned content

Use base64 coding for xxe to prevent verification of return packets

Return base64 packet, base64 decode

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.