Shulou(Shulou.com)05/31 Report--

How to understand the recurrence of XXE loopholes in PHP websites? in view of this problem, this article introduces the corresponding analysis and solutions in detail, hoping to help more partners who want to solve this problem to find a more simple and feasible way.

"XXE: XML External Entity Injection, XML external entity, also known as XML external entity injection attack, vulnerability is a security problem caused by the processing of insecure external entity data. Say no more, ahem-open!

Step1: login

Enter an incorrect user name and password, indicating an error. "

Step2: grab the bag

Open burpsuite to grab the login packet and send it to the repeater module.

GO, the normal response data, the response code is 200, the content result is 1admin.

Step3: inserting XXE

Insert the XXE entity code in the request information

Step4: getting information

The contents of the server side c:\ windows\ win.ini file have been obtained.

Step5: changin

Modify the XXE entity code again to access system.ini

Entity symbol

& ampIt; greater than sign & amp& and sign & ampapos;' single quotation mark & ampquot; "quotation mark

Default protocol

LIBXML2PHPJAVA.NETfilefilehttpfilehttphttphttpshttpftpftpftphttpsphpfileftppharjar

Defense against XXE:

1. Use a simple data format (JSON) to avoid serializing sensitive data.

2. Repair and update the XML processors and libraries used by the application or underlying operating system in time.

3. Filter the XML data submitted by users.

4. Use the method provided by the development language to disable external entities.

5. Timely use of tools to prevent and detect XXE vulnerabilities.

This is the answer to the question about how to understand the recurrence of XXE loopholes in PHP websites. I hope the above content can be of some help to you. If you still have a lot of doubts to be solved, you can follow the industry information channel to learn more about it.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.