Using xxe to obtain passwd of linux system
Reference an external DTD file to access the intranet host / port.
(see response time)
Reference external DTD files to access the wai network.
Reference an internal entity.
& xxe
External entities read local files.
& xxe
The external entity accesses the inner wang host port.
(see response time)
External entities access the wai network.
& xxe
Download the rrodrigo/xxelab image in docker
Start: docker run-d-p 8082VOL80 rrodrigo/xxelab
Grab the registration package and find that it is delivered in xml format, and the mailbox returns:
Xxe echo setting read / etc/passwd will be performed at the returned content
Use base64 coding for xxe to prevent verification of return packets
Return base64 packet, base64 decode
