XML external entity (XXE) injection

burpsuit 靶场的 xxe

APPRENTICE （学徒）

利用XXE 执行外部文件

Exploiting XXE using external entities to retrieve files

目标 ：
This lab has a “Check stock” feature that parses XML input and returns any unexpected values in the response.
To solve the lab, inject an XML external entity to retrieve the contents of the /etc/passwd file.

进入实验室

是一个卖东西的网站 抓包 看看数据
当我点击 Check stock 抓包

发现 post 数据里面存在xml 格式的数据
如果把数据改成我们想要的内容了 比如执行system 获取文件内容
使用 file协议直接读取到了 /etc/passwd 文件

payload

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE ANY [
<!ENTITY file SYSTEM "file:///etc/passwd"> ]>
<stockCheck><productId>&file;</productId><storeId>1</storeId></stockCheck>

利用 XXE 执行 SSRF 攻击

（Exploiting XXE to perform SSRF attacks）

目标 ：
This lab has a “Check stock” feature that parses XML input and returns any unexpected values in the response.
The lab server is running a (simulated) EC2 metadata endpoint at the default URL, which is http://169.254.169.254/. This endpoint can be used to retrieve data about the instance, some of which might be sensitive.
To solve the lab, exploit the XXE vulnerability to perform an SSRF attack that obtains the server’s IAM secret access key from the EC2 metadata endpoint.

还是一样的检索数据的 功能